Updated 05/02/2025
In force

Initial Legal Act
Amendments
Aufsichtsmitteilung zur Umsetzung von DORA
Updated: 19/09/2024
Published: 08/07/2024
Art. 24
Search within this legal act
DORA ToolDelegated Regulation 2024/1774
Article 24

Article 24 - Delegated Regulation 2024/1774

Article 24

Components of the ICT business continuity policy

1.   Financial entities shall include in their ICT business continuity policy referred to in Article 11(1) of Regulation (EU) 2022/2554 all of the following:

(a)

a description of:

(i)

the objectives of the ICT business continuity policy, including the interrelation of ICT and overall business continuity, and considering the results of the business impact analysis (BIA) referred to in Article 11(5) of Regulation (EU) 2022/2554;

(ii)

the scope of the ICT business continuity arrangements, plans, procedures, and mechanisms, including limitations and exclusions;

(iii)

the timeframe to be covered by the ICT business continuity arrangements, plans, procedures, and mechanisms;

(iv)

the criteria to activate and deactivate ICT business continuity plans, ICT response and recovery plans, and crisis communications plans;

(b)

provisions on:

(i)

the governance and organisation to implement the ICT business continuity policy, including roles, responsibilities and escalation procedures ensuring that sufficient resources are available;

(ii)

the alignment between the ICT business continuity plans and the overall business continuity plans, concerning at least all of the following:

(1)

potential failure scenarios, including the scenarios referred to in Article 26(2) of this Regulation;

(2)

recovery objectives, specifying that the financial entity shall be able to recover the operations of its critical or important functions after disruptions within a recovery time objective and a recovery point objective;

(iii)

the development of ICT business continuity plans for severe business disruptions as part of those plans, and the prioritisation of ICT business continuity actions using a risk-based approach;

(iv)

the development, testing and review of ICT response and recovery plans, in accordance with Articles 25 and 26 of this Regulation;

(v)

the review of the effectiveness of the implemented ICT business continuity arrangements, plans, procedures and mechanisms, in accordance with Article 26 of this Regulation;

(vi)

the alignment of the ICT business continuity policy to:

(1)

the communication policy referred to in Article 14(2) of Regulation (EU) 2022/2554;

(2)

the communication and crisis communication actions referred to in Article 11(2), point (e), of Regulation (EU) 2022/2554.

2.   In addition to the requirements referred to in paragraph 1, central counterparties shall ensure that their ICT business continuity policy:

(a)

contains a maximum recovery time for their critical functions that is not longer than 2 hours;

(b)

takes into account external links and interdependencies within the financial infrastructures, including trading venues cleared by the central counterparty, securities settlement and payment systems, and credit institutions used by the central counterparty or a linked central counterparty;

(c)

requires that arrangements are in place to:

(i)

ensure the continuity of critical or important functions of the central counterparty based on disaster scenarios;

(ii)

maintain a secondary processing site capable of ensuring continuity of critical or important functions of the central counterparty identical to the primary site;

(iii)

maintain or have immediate access to a secondary business site, to allow staff to ensure continuity of the service if the primary location of business is not available;

(iv)

consider the need for additional processing sites, in particular where the diversity of the risk profiles of the primary and secondary sites does not provide sufficient confidence that the central counterparty’s business continuity objectives will be met in all scenarios.

For the purposes of point (a), central counterparties shall complete end of day procedures and payments on the required time and day in all circumstances.

For the purposes of point (c)(i), arrangements referred to in that point shall address the availability of adequate human resources, the maximum downtime of critical functions, and fail over and recovery to a secondary site.

For the purposes of point (c)(ii), the secondary processing site referred to in that point shall have a geographical risk profile which is distinct from that of the primary site.

3.   In addition to the requirements referred to in paragraph 1, central securities depositories shall ensure that their ICT business continuity policy:

(a)

takes into account any links and interdependencies to users, critical utilities and critical service providers, other central securities depositories and other market infrastructures;

(b)

requires its ICT business continuity arrangements to ensure that the recovery time objective for their critical or important functions shall not be longer than 2 hours.

4.   In addition to the requirements referred to in paragraph 1, trading venues shall ensure that their ICT business continuity policy ensures that:

(a)

trading can be resumed within or close to 2 hours of a disruptive incident;

(b)

the maximum amount of data that may be lost from any IT service of the trading venue after a disruptive incident is close to zero.