Guidelines on ICT and Security Risk Management

These Guidelines were developed by the European Banking Authority (EBA) to standardize ICT and security risk management practices in the EU financial system. They apply to credit institutions, investment firms, and payment service providers and aim to mitigate operational and ICT risks effectively. The Guidelines will replace the EBA GL/2017/17 Guidelines on security measures for operational and security risks. They are aligned with the Digital Operational Resilience Act (DORA), which harmonizes ICT risk management practices in the financial sector. The Guidelines focus on a simplified framework for managing ICT risks, including operational resilience, and are set to take effect on May 20, 2025.