🤖 Introducing Solcis, our new sister company for AI agent compliance. Read more
MarketplaceCybersecurityGuidelines on ICT and Security Risk Management
CybersecurityGuideline

Guidelines on ICT and Security Risk Management

The EBA Guidelines establish requirements for credit institutions, investment firms, and payment service providers on mitigating and managing information and communication technology (ICT) risks. They aim to ensure a consistent and robust approach to ICT and security risk management across the EU financial sector.

Book your strategy callView source ↗

Overview

These Guidelines were developed by the European Banking Authority (EBA) to standardize ICT and security risk management practices in the EU financial system. They apply to credit institutions, investment firms, and payment service providers and aim to mitigate operational and ICT risks effectively. The Guidelines will replace the EBA GL/2017/17 Guidelines on security measures for operational and security risks. They are aligned with the Digital Operational Resilience Act (DORA), which harmonizes ICT risk management practices in the financial sector. The Guidelines focus on a simplified framework for managing ICT risks, including operational resilience, and are set to take effect on May 20, 2025.

Related in Cybersecurity

CybersecurityFramework

ASD Essentials for Cloud

The ASD Essentials for Cloud is an Australian cybersecurity framework that provides a threat-informed, risk-based approach for securing cloud environments, helping organizations protect cloud services, data, identities, applications, and integrations from cyber threats.

Australian Signals Directorate (ASD)

View details
CybersecurityFramework

ASD Essentials for Operational Technology (OT)

The ASD Essentials for Operational Technology (OT) is an Australian cybersecurity framework that provides risk-based guidance for securing industrial control systems, cyber-physical systems, and other operational technology environments through prioritized security principles, actions, and domains tailored to OT-specific risks and operational requirements.

Australian Signals Directorate (ASD) • Australia

View details
CybersecurityFramework

ASD Essentials for Enterprise IT

The ASD Essentials for Cloud is a cybersecurity framework developed by the Australian Signals Directorate (ASD) to help organizations protect cloud environments from sophisticated cyber threats. It provides a structured approach based on Principles, Actions, and Domains for securing SaaS and PaaS environments, with a focus on identity, data, configurations, applications, integrations, and provider assurance.

Australian Signals Directorate (ASD) • Australia

View details
CybersecurityRegulation

RFFR ISM PSP-A — RFFR ISM Provider Security Plan Annex Template

The RFFR Provider Security Plan Annex (PSP-A) Template is a DEWR security assurance template used to document the implementation and status of security controls that protect departmental information and support the secure delivery of services under the Right Fit For Risk (RFFR) framework.

Australian Government • Australia • vSeptember 2026

View details

Ready to manage these frameworks?

6clicks maps regulations to controls, evidence and risks — automatically.

Book your strategy call