Security Awareness & Training Management
- Article 5(2)(g): Approve Resilience Budget and Training (Reg. EU 2022/2554, Chapter II)
- Article 13(6): Mandatory Staff Digital Resilience Training (Reg. EU 2022/2554, Chapter II)
ICT Asset & Dependency Mapping
- Article 8(1): Identify and Classify ICT Assets (Reg. EU 2022/2554, Chapter II)
- Article 5(b): Record Detailed ICT Asset Inventory (CDR 2024/1774, Title II, Chapter I, Section 1)
Network Security & Configuration Management
- Article 9(2): Ensure ICT System Resilience/Security (Reg. EU 2022/2554, Chapter II)
- Article 11(b): Define Secure Configuration Baseline (CDR 2024/1774, Title II, Chapter I, Section 4)
- Article 13: Implement Robust Network Segregation (CDR 2024/1774, Title II, Chapter I, Section 4)
Vulnerability & Patch Management
- Article 10(1): Implement Vulnerability Management Procedures (CDR 2024/1774, Title II, Chapter I, Section 3)
- Article 10(2)(d): Track Third-Party Code Usage (CDR 2024/1774, Title II, Chapter I, Section 3)
- Article 10(3)–(4): Automate ICT Patch Management (CDR 2024/1774, Title II, Chapter I, Section 3)
Cryptography & Key Management
- Article 9(4): Information Security and Access Controls (Reg. EU 2022/2554, Chapter II)
- Article 8: Encrypt Data At Rest/In-Transit (CDR 2024/1774, Title II, Chapter I, Section 2)
Identity & Access Management
- Article 21: Enforce Least Privilege Access Controls (CDR 2024/1774, Title II, Chapter II)
Development, Testing & Change Management
- Article 15: Specify ICT Project Management Elements (CDR 2024/1774, Title II, Chapter I, Section 7)
- Article 16(1): Secure ICT Acquisition and Development (CDR 2024/1774, Title II, Chapter I, Section 7)
- Article 16(3): Mandate Source Code Security Reviews (CDR 2024/1774, Title II, Chapter I, Section 7)
Security Information & Event Management / Logging
- Article 9(4): Information Security and Access Controls (Reg. EU 2022/2554, Chapter II)
- Article 12(1)(d): Protect Log Systems From Tampering (CDR 2024/1774, Title II, Chapter I, Section 5)
- Article 12(1)(f): Synchronise All ICT System Clocks (CDR 2024/1774, Title II, Chapter I, Section 5)
Anomaly & Intrusion Detection
- Article 10(1): Prompt Detection of Anomalous Activity (Reg. EU 2022/2554, Chapter II)
- Article 23(c): Prioritise Anomalous Activity Alerts (CDR 2024/1774, Title II, Chapter III)
Technical Security Testing & Assessment
- Article 24(1): Comprehensive Digital Resilience Testing Programme (Reg. EU 2022/2554, Chapter IV)
- Article 24(6): Annual Testing Critical ICT Functions (Reg. EU 2022/2554, Chapter IV)
- Article 25(1): Execute Diverse Resilience Tests (Reg. EU 2022/2554, Chapter IV)
Incident Triage & Tracking System
- Article 17(1): Define Incident Management Process (Reg. EU 2022/2554, Chapter III)
- Article 17(3)(a): Implement Early Warning Indicators (Reg. EU 2022/2554, Chapter III)
- Article 17(3)(b): Classify Incidents by Priority/Severity (Reg. EU 2022/2554, Chapter III)
- Article 1: Clients, Counterparts, Transactions Criteria (CDR 2024/1772, Chapter I)
Backup & Restoration Management
- Article 12(1): Document Backup and Recovery Procedures (Reg. EU 2022/2554, Chapter II)
- Article 12(7): Ensure Data Integrity Post-Recovery (Reg. EU 2022/2554, Chapter II)
- Article 12(2)(a): Geographically Separate Secondary Processing Site (Reg. EU 2022/2554, Chapter II)
Threat-Led Penetration Testing Platform
- Article 26(1): TLPT Requirement (Reg. EU 2022/2554, Chapter IV)
- Article 7(1): Requirements for Testers / Threat-Intelligence Provider (CDR 2025/1190)
- Article 9(6): Scope Approval by the TLPT Authority (CDR 2025/1190)
- Article 9(4)(a): Encrypted Communication / Test Secrecy (CDR 2025/1190)