EBA amends ICT and security risk management Guidelines in preparation for DORA implementation

Article summary

The European Banking Authority (EBA) has published a final report on the amendment of its Guidelines on ICT and security risk management measures due to the application of the Digital Operational Resilience Act (DORA) from 17 January 2025. These amendments aim to simplify the ICT risk management framework and provide legal clarity to the market. DORA introduces harmonised ICT risk management requirements for financial entities across various sectors. The EBA has narrowed the scope of its Guidelines to entities covered by DORA and specific requirements for managing relationships with payment services. The amended Guidelines will apply within two months of the publication of the translated versions.