convert_library_version: 'v2 ; Compat Mode: [0] {[v2.1] (DEFAULT) Don''t use any Compatibility
  Mode}'
urn: urn:intuitem:risk:library:rts-dora-ict-risk-management
locale: en
ref_id: RTS-DORA-ICT-risk-management
name: RTS on ICT risk management framework and on simplified ICT risk management framework
description: 'One of the objectives of Regulation (EU) 2022/2554 on digital operational
  resilience for the financial sector (DORA) is to set out uniform requirements for
  the security of network and information systems of companies and organisations operating
  in the financial sector. It thus creates a regulatory framework on digital operational
  resilience, whereby all financial entities need to make sure they can withstand,
  respond to, and recover from all types of ICT-related disruptions and threats. These
  requirements are homogenous across the EU, with the aim of preventing and mitigating
  cyber threats.

  Link : https://eur-lex.europa.eu/legal-content/EN/ALL/?uri=CELEX:32024R1774'
copyright: EUROPEAN COMMISSION
version: 2
publication_date: 2025-09-16
provider: EUROPEAN COMMISSION
packager: intuitem
translations:
  fr:
    name: "RTS sur le framework de gestion des risques TIC et sur le framework simplifi\xE9\
      \ de gestion des risques TIC"
    description: "Le r\xE8glement (UE) 2022/2554 couvre un large \xE9ventail d\u2019\
      entit\xE9s financi\xE8res qui diff\xE8rent par leur taille, leur structure,\
      \ leur organisation interne, ainsi que par la nature et la complexit\xE9 de\
      \ leurs activit\xE9s, et qui pr\xE9sentent donc des facteurs plus ou moins grands\
      \ de complexit\xE9 ou de risque. Afin que cette diversit\xE9 soit d\xFBment\
      \ prise en consid\xE9ration, toute exigence relative aux politiques, proc\xE9\
      dures, protocoles et outils de s\xE9curit\xE9 des TIC, ainsi qu\u2019\xE0 un\
      \ cadre simplifi\xE9 de gestion du risque li\xE9 aux TIC, devrait \xEAtre proportionn\xE9\
      e \xE0 la taille, \xE0 la structure, \xE0 l\u2019organisation interne, \xE0\
      \ la nature et \xE0 la complexit\xE9 de ces entit\xE9s financi\xE8res, ainsi\
      \ qu\u2019aux risques correspondants.\nLien : https://eur-lex.europa.eu/legal-content/FR/ALL/?uri=CELEX:32024R1774"
    copyright: "COMMISSION EUROP\xC9ENNE"
objects:
  framework:
    urn: urn:intuitem:risk:framework:rts-dora-ict-risk-management
    ref_id: RTS-DORA-ICT-risk-management
    name: RTS on ICT risk management framework and on simplified ICT risk management
      framework
    description: 'One of the objectives of Regulation (EU) 2022/2554 on digital operational
      resilience for the financial sector (DORA) is to set out uniform requirements
      for the security of network and information systems of companies and organisations
      operating in the financial sector. It thus creates a regulatory framework on
      digital operational resilience, whereby all financial entities need to make
      sure they can withstand, respond to, and recover from all types of ICT-related
      disruptions and threats. These requirements are homogenous across the EU, with
      the aim of preventing and mitigating cyber threats.

      Link : https://eur-lex.europa.eu/legal-content/EN/ALL/?uri=CELEX:32024R1774'
    translations:
      fr:
        name: "RTS sur le framework de gestion des risques TIC et sur le framework\
          \ simplifi\xE9 de gestion des risques TIC"
        description: "Le r\xE8glement (UE) 2022/2554 couvre un large \xE9ventail d\u2019\
          entit\xE9s financi\xE8res qui diff\xE8rent par leur taille, leur structure,\
          \ leur organisation interne, ainsi que par la nature et la complexit\xE9\
          \ de leurs activit\xE9s, et qui pr\xE9sentent donc des facteurs plus ou\
          \ moins grands de complexit\xE9 ou de risque. Afin que cette diversit\xE9\
          \ soit d\xFBment prise en consid\xE9ration, toute exigence relative aux\
          \ politiques, proc\xE9dures, protocoles et outils de s\xE9curit\xE9 des\
          \ TIC, ainsi qu\u2019\xE0 un cadre simplifi\xE9 de gestion du risque li\xE9\
          \ aux TIC, devrait \xEAtre proportionn\xE9e \xE0 la taille, \xE0 la structure,\
          \ \xE0 l\u2019organisation interne, \xE0 la nature et \xE0 la complexit\xE9\
          \ de ces entit\xE9s financi\xE8res, ainsi qu\u2019aux risques correspondants.\n\
          Lien : https://eur-lex.europa.eu/legal-content/FR/ALL/?uri=CELEX:32024R1774"
    requirement_nodes:
    - urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:title-i
      assessable: false
      depth: 1
      ref_id: TITLE I
      description: GENERAL PRINCIPLE
      translations:
        fr:
          name: TITRE I
          description: "PRINCIPE G\xC9N\xC9RAL"
    - urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:article-1
      assessable: false
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:title-i
      ref_id: Article 1
      description: Overall risk profile and complexity
      translations:
        fr:
          description: "Profil de risque global et complexit\xE9"
    - urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:article-1:1
      assessable: true
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:article-1
      description: 'When developing and implementing the ICT security policies, procedures,
        protocols and tools referred to in Title II and the simplified ICT risk management
        framework referred to in Title III, the size and the overall risk profile
        of the financial entity, and the nature, scale and elements of increased or
        reduced complexity of its services, activities and operations shall be taken
        into account, including elements relating to:'
      translations:
        fr:
          description: "Lors de l\u2019\xE9laboration et de la mise en \u0153uvre\
            \ des politiques, proc\xE9dures, protocoles et outils de s\xE9curit\xE9\
            \ de TIC vis\xE9s au titre II et du cadre simplifi\xE9 de gestion du risque\
            \ li\xE9 aux TIC vis\xE9 au titre III, il est tenu compte de la taille\
            \ et du profil de risque global de l\u2019entit\xE9 financi\xE8re, ainsi\
            \ que de la nature, de l\u2019\xE9chelle et des \xE9l\xE9ments tendant\
            \ \xE0 accro\xEEtre ou r\xE9duire la complexit\xE9 de ses services, activit\xE9\
            s et op\xE9rations, notamment des \xE9l\xE9ments concernant:"
    - urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:1.a
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:article-1:1
      ref_id: 1.a
      description: encryption and cryptography;
      translations:
        fr:
          description: le chiffrement et la cryptographie;
    - urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:1.b
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:article-1:1
      ref_id: 1.b
      description: ICT operations security;
      translations:
        fr:
          description: "la s\xE9curit\xE9 des op\xE9rations de TIC;"
    - urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:1.c
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:article-1:1
      ref_id: 1.c
      description: network security;
      translations:
        fr:
          description: "la s\xE9curit\xE9 des r\xE9seaux;"
    - urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:1.d
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:article-1:1
      ref_id: 1.d
      description: ICT project and change management;
      translations:
        fr:
          description: la gestion des projets TIC et des changements dans les TIC;
    - urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:1.e
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:article-1:1
      ref_id: 1.e
      description: "the potential impact of the ICT risk on confidentiality, integrity\
        \ and availability of data, and of the disruptions on the continuity and availability\
        \ of the financial entity\u2019s activities."
      translations:
        fr:
          description: "l\u2019incidence potentielle du risque li\xE9 aux TIC sur\
            \ la confidentialit\xE9, l\u2019int\xE9grit\xE9 et la disponibilit\xE9\
            \ des donn\xE9es, et l\u2019incidence potentielle des perturbations sur\
            \ la continuit\xE9 et la disponibilit\xE9 des activit\xE9s de l\u2019\
            entit\xE9 financi\xE8re."
    - urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:title-ii
      assessable: false
      depth: 1
      ref_id: TITLE II
      description: FURTHER HARMONISATION OF ICT RISK MANAGEMENT TOOLS, METHODS, PROCESSES,
        AND POLICIES IN ACCORDANCE WITH ARTICLE 15 OF REGULATION (EU) 2022/2554
      translations:
        fr:
          name: TITRE II
          description: "HARMONISATION ACCRUE DES OUTILS, M\xC9THODES, PROCESSUS ET\
            \ POLITIQUES DE GESTION DU RISQUE LI\xC9 AUX TIC CONFORM\xC9MENT \xC0\
            \ L\u2019ARTICLE 15 DU R\xC8GLEMENT (UE) 2022/2554"
    - urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:title-ii:1
      assessable: false
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:title-ii
      name: CHAPTER I
      description: ICT SECURITY POLICIES, PROCEDURES, PROTOCOLS, AND TOOLS
      translations:
        fr:
          name: CHAPITRE I
          description: "Politiques, proc\xE9dures, protocoles et outils de s\xE9curit\xE9\
            \ des TIC"
    - urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:section-1
      assessable: false
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:title-ii:1
      ref_id: SECTION 1
    - urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:article-2
      assessable: false
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:section-1
      ref_id: Article 2
      description: General elements of ICT security policies, procedures, protocols,
        and tools
      translations:
        fr:
          description: "\xC9l\xE9ments g\xE9n\xE9raux des politiques, proc\xE9dures,\
            \ protocoles et outils de s\xE9curit\xE9 des TIC"
    - urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:2.1
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:article-2
      ref_id: '2.1'
      description: 'Financial entities shall ensure that their ICT security policies,
        information security, and related procedures, protocols, and tools as referred
        to in Article 9(2) of Regulation (EU) 2022/2554 are embedded in their ICT
        risk management framework. Financial entities shall establish the ICT security
        policies, procedures, protocols, and tools laid down in this Chapter that:'
      translations:
        fr:
          description: "Les entit\xE9s financi\xE8res veillent \xE0 ce que leurs politiques\
            \ de s\xE9curit\xE9 des TIC, la s\xE9curit\xE9 de l\u2019information et\
            \ les proc\xE9dures, protocoles et outils y aff\xE9rents vis\xE9s \xE0\
            \ l\u2019article 9, paragraphe 2, du r\xE8glement (UE) 2022/2554 soient\
            \ int\xE9gr\xE9s dans leur cadre de gestion du risque li\xE9 aux TIC.\
            \ Les entit\xE9s financi\xE8res \xE9tablissent les politiques, proc\xE9\
            dures, protocoles et outils de s\xE9curit\xE9 des TIC pr\xE9vus au pr\xE9\
            sent chapitre qui:"
    - urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:2.1.a
      assessable: true
      depth: 6
      parent_urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:2.1
      ref_id: 2.1.a
      description: ensure the security of networks;
      translations:
        fr:
          description: "garantissent la s\xE9curit\xE9 des r\xE9seaux;"
    - urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:2.1.b
      assessable: true
      depth: 6
      parent_urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:2.1
      ref_id: 2.1.b
      description: contain safeguards against intrusions and data misuse;
      translations:
        fr:
          description: "comportent des garanties contre les intrusions et les utilisations\
            \ abusives des donn\xE9es;"
    - urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:2.1.c
      assessable: true
      depth: 6
      parent_urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:2.1
      ref_id: 2.1.c
      description: preserve the availability, authenticity, integrity, and confidentiality
        of data,including via the use of cryptographic techniques;
      translations:
        fr:
          description: "pr\xE9servent la disponibilit\xE9, l\u2019authenticit\xE9\
            , l\u2019int\xE9grit\xE9 et la confidentialit\xE9 des donn\xE9es, y compris\
            \ en recourant \xE0 des techniques cryptographiques;"
    - urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:2.1.d
      assessable: true
      depth: 6
      parent_urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:2.1
      ref_id: 2.1.d
      description: guarantee an accurate and prompt data transmission without major
        disruptions and undue delays.
      translations:
        fr:
          description: "garantissent une transmission pr\xE9cise et rapide des donn\xE9\
            es sans perturbation majeure et sans retard injustifi\xE9."
    - urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:2.2
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:article-2
      ref_id: '2.2'
      description: 'Financial entities shall ensure that the ICT security policies
        referred to in paragraph 1:'
      translations:
        fr:
          description: "Les entit\xE9s financi\xE8res veillent \xE0 ce que les politiques\
            \ de s\xE9curit\xE9 des TIC vis\xE9es au paragraphe 1:"
    - urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:2.2.a
      assessable: true
      depth: 6
      parent_urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:2.2
      ref_id: 2.2.a
      description: "are aligned to the financial entity\u2019s information security\
        \ objectives included in the digital operational resilience strategy referred\
        \ to in Article 6(8) of Regulation (EU) 2022/2554;"
      translations:
        fr:
          description: "soient align\xE9es sur les objectifs de l\u2019entit\xE9 financi\xE8\
            re en mati\xE8re de s\xE9curit\xE9 de l\u2019information d\xE9finis dans\
            \ la strat\xE9gie de r\xE9silience op\xE9rationnelle num\xE9rique vis\xE9\
            e \xE0 l\u2019article 6, paragraphe 8, du r\xE8glement (UE) 2022/2554;"
    - urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:2.2.b
      assessable: true
      depth: 6
      parent_urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:2.2
      ref_id: 2.2.b
      description: indicate the date of the formal approval of the ICT security policies
        by the management body;
      translations:
        fr:
          description: "indiquent la date de l\u2019approbation formelle des politiques\
            \ de s\xE9curit\xE9 des TIC par l\u2019organe de direction;"
    - urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:2.2.c
      assessable: true
      depth: 6
      parent_urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:2.2
      ref_id: 2.2.c
      description: 'contain indicators and measures to:'
      translations:
        fr:
          description: 'contiennent des indicateurs et des mesures pour:'
    - urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:2.2.c.i
      assessable: true
      depth: 7
      parent_urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:2.2.c
      ref_id: 2.2.c.i
      description: monitor the implementation of the ICT security policies, procedures,
        protocols, and tools
      translations:
        fr:
          description: "suivre la mise en \u0153uvre des politiques, proc\xE9dures,\
            \ protocoles et outils de s\xE9curit\xE9 des TIC;"
    - urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:2.c.ii
      assessable: true
      depth: 7
      parent_urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:2.2.c
      ref_id: 2.c.ii
      description: record exceptions from that implementation
      translations:
        fr:
          description: "enregistrer les exceptions \xE0 cette mise en \u0153uvre;"
    - urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:2.c.iii
      assessable: true
      depth: 7
      parent_urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:2.2.c
      ref_id: 2.c.iii
      description: ensure that the digital operational resilience of the financial
        entity is ensured in case of exceptions as referred to in point (ii);
      translations:
        fr:
          description: "veiller \xE0 ce que la r\xE9silience op\xE9rationnelle num\xE9\
            rique de l\u2019entit\xE9 financi\xE8re soit assur\xE9e en cas d\u2019\
            exceptions vis\xE9es au point ii);"
    - urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:2.2.d
      assessable: true
      depth: 6
      parent_urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:2.2
      ref_id: 2.2.d
      description: "specify the responsibilities of staff at all levels to ensure\
        \ the financial entity\u2019s\nICT security;"
      translations:
        fr:
          description: "pr\xE9cisent les responsabilit\xE9s du personnel \xE0 tous\
            \ les niveaux afin d\u2019assurer la s\xE9curit\xE9 des TIC de l\u2019\
            entit\xE9 financi\xE8re;"
    - urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:2.2.e
      assessable: true
      depth: 6
      parent_urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:2.2
      ref_id: 2.2.e
      description: specify the consequences of non-compliance by staff of the financial
        entity with the ICT security policies, where provisions to that effect are
        not laid down in other policies of the financial entity;
      translations:
        fr:
          description: "pr\xE9cisent les cons\xE9quences du non-respect, par le personnel\
            \ de l\u2019entit\xE9 financi\xE8re, des politiques de s\xE9curit\xE9\
            \ des TIC, lorsque des dispositions \xE0 cet effet ne sont pas pr\xE9\
            vues dans d\u2019autres politiques de l\u2019entit\xE9 financi\xE8re;"
    - urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:2.2.f
      assessable: true
      depth: 6
      parent_urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:2.2
      ref_id: 2.2.f
      description: list the documentation to be maintained;
      translations:
        fr:
          description: "r\xE9pertorient les documents \xE0 tenir \xE0 jour;"
    - urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:2.2.g
      assessable: true
      depth: 6
      parent_urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:2.2
      ref_id: 2.2.g
      description: specify the segregation of duties arrangements in the context of
        the three lines of defence model or other internal risk management and control
        model, as applicable, to avoid conflicts of interest;
      translations:
        fr:
          description: "pr\xE9cisent les modalit\xE9s de s\xE9paration des fonctions\
            \ dans le cadre du mod\xE8le reposant sur trois lignes de d\xE9fense ou\
            \ d\u2019un autre mod\xE8le interne de gestion et de contr\xF4le des risques,\
            \ selon le cas, afin d\u2019\xE9viter les conflits d\u2019int\xE9r\xEA\
            ts;"
    - urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:2.2.h
      assessable: true
      depth: 6
      parent_urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:2.2
      ref_id: 2.2.h
      description: consider leading practices and, where applicable, standards as
        defined in Article 2, point (1), of Regulation (EU) No 1025/2012;
      translations:
        fr:
          description: "tiennent compte des pratiques de pointe et, le cas \xE9ch\xE9\
            ant, des normes telles que d\xE9finies \xE0 l\u2019article 2, point 1),\
            \ du r\xE8glement (UE) no 1025/2012;"
    - urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:2.2.i
      assessable: true
      depth: 6
      parent_urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:2.2
      ref_id: 2.2.i
      description: identify the roles and responsibilities for the development, implementation
        and maintenance of ICT security policies, procedures, protocols, and tools;
      translations:
        fr:
          description: "d\xE9finissent les r\xF4les et les responsabilit\xE9s en ce\
            \ qui concerne l\u2019\xE9laboration, la mise en \u0153uvre et la maintenance\
            \ des politiques, proc\xE9dures, protocoles et outils de s\xE9curit\xE9\
            \ des TIC;"
    - urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:2.2.j
      assessable: true
      depth: 6
      parent_urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:2.2
      ref_id: 2.2.j
      description: are reviewed in accordance with Article 6(5) of Regulation (EU)
        2022/2554;
      translations:
        fr:
          description: "soient r\xE9examin\xE9es conform\xE9ment \xE0 l\u2019article\
            \ 6, paragraphe 5, du r\xE8glement (UE) 2022/2554;"
    - urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:2.2.k
      assessable: true
      depth: 6
      parent_urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:2.2
      ref_id: 2.2.k
      description: take into account material changes concerning the financial entity,
        including material changes to the activities or processes of the financial
        entity, to the cyber threat landscape, or to applicable legal obligations.
      translations:
        fr:
          description: "tiennent compte des changements importants concernant l\u2019\
            entit\xE9 financi\xE8re, notamment des changements importants intervenant\
            \ dans ses activit\xE9s ou processus, dans l\u2019\xE9ventail des cybermenaces\
            \ ou dans les obligations l\xE9gales applicables."
    - urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:section-2
      assessable: false
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:title-ii:1
      ref_id: SECTION 2
    - urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:article-3
      assessable: false
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:section-2
      ref_id: Article 3
      description: ICT risk management
      translations:
        fr:
          description: "Gestion du risque li\xE9 aux TIC"
    - urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:article-3:1
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:article-3
      description: 'Financial entities shall develop, document, and implement ICT
        risk management policies and procedures that shall contain all of the following:'
      translations:
        fr:
          description: "Les entit\xE9s financi\xE8res \xE9laborent, documentent et\
            \ mettent en \u0153uvre des politiques et proc\xE9dures de gestion du\
            \ risque li\xE9 aux TIC qui contiennent l\u2019ensemble des \xE9l\xE9\
            ments suivants:"
    - urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:3.a
      assessable: true
      depth: 6
      parent_urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:article-3:1
      ref_id: 3.a
      description: an indication of the approval of the risk tolerance level for ICT
        risk established in accordance with Article 6(8), point (b), of Regulation
        (EU) 2022/2554;
      translations:
        fr:
          description: "l\u2019indication de l\u2019approbation du niveau de tol\xE9\
            rance au risque li\xE9 aux TIC d\xE9termin\xE9 conform\xE9ment \xE0 l\u2019\
            article 6, paragraphe 8, point b), du r\xE8glement (UE) 2022/2554;"
    - urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:3.b
      assessable: true
      depth: 6
      parent_urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:article-3:1
      ref_id: 3.b
      description: 'a procedure and a methodology to conduct the ICT risk assessment,
        identifying:'
      translations:
        fr:
          description: "une proc\xE9dure et une m\xE9thode d\u2019\xE9valuation du\
            \ risque li\xE9 aux TIC, pr\xE9cisant:"
    - urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:3.b.i
      assessable: true
      depth: 7
      parent_urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:3.b
      ref_id: 3.b.i
      description: vulnerabilities and threats that affect or may affect the supported
        business functions, the ICT systems and ICT assets supporting those functions;
      translations:
        fr:
          description: "les vuln\xE9rabilit\xE9s et les menaces qui affectent ou peuvent\
            \ affecter les fonctions op\xE9rationnelles soutenues et les syst\xE8\
            mes de TIC et actifs de TIC qui les soutiennent;"
    - urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:3.b.ii
      assessable: true
      depth: 7
      parent_urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:3.b
      ref_id: 3.b.ii
      description: the quantitative or qualitative indicators to measure the impact
        and likelihood of the vulnerabilities and threats referred to in point (i);
      translations:
        fr:
          description: "les indicateurs quantitatifs ou qualitatifs \xE0 utiliser\
            \ pour mesurer l\u2019incidence et la probabilit\xE9 des vuln\xE9rabilit\xE9\
            s et des menaces vis\xE9es au point i);"
    - urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:3.c
      assessable: true
      depth: 6
      parent_urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:article-3:1
      ref_id: 3.c
      description: the procedure to identify, implement, and document ICT risk treatment
        measures for the ICT risks identified and assessed, including the determination
        of ICT risk treatment measures necessary to bring ICT risk within the risk
        tolerance level referred to in point (a);
      translations:
        fr:
          description: "la proc\xE9dure de d\xE9termination, de mise en \u0153uvre\
            \ et de documentation des mesures de traitement du risque li\xE9 aux TIC\
            \ pour les risques li\xE9s aux TIC qui ont \xE9t\xE9 identifi\xE9s et\
            \ \xE9valu\xE9s, y compris la d\xE9finition des mesures de traitement\
            \ du risque li\xE9 aux TIC n\xE9cessaires pour ramener ce risque dans\
            \ les limites du niveau de tol\xE9rance au risque vis\xE9 au point a);"
    - urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:3.d
      assessable: true
      depth: 6
      parent_urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:article-3:1
      ref_id: 3.d
      description: 'for the residual ICT risks that are still present following the
        implementation of the ICT risk treatment measures referred to in point (c):'
      translations:
        fr:
          description: "pour les risques r\xE9siduels li\xE9s aux TIC qui sont toujours\
            \ pr\xE9sents \xE0 l\u2019issue de la mise en \u0153uvre des mesures de\
            \ traitement du risque li\xE9 aux TIC vis\xE9es au point c):"
    - urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:3.d.i
      assessable: true
      depth: 7
      parent_urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:3.d
      ref_id: 3.d.i
      description: provisions on the identification of those residual ICT risks;
      translations:
        fr:
          description: "des dispositions relatives \xE0 l\u2019identification de ces\
            \ risques r\xE9siduels li\xE9s aux TIC;"
    - urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:3.d.ii
      assessable: true
      depth: 7
      parent_urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:3.d
      ref_id: 3.d.ii
      description: 'the assignment of roles and responsibilities regarding:'
      translations:
        fr:
          description: "l\u2019attribution des r\xF4les et des responsabilit\xE9s\
            \ concernant:"
    - urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:3.d.ii.1
      assessable: true
      depth: 8
      parent_urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:3.d.ii
      ref_id: 3.d.ii.1
      description: "the acceptance of the residual ICT risks that exceed the financial\
        \ entity\u2019s risk tolerance level referred to in point (a);"
      translations:
        fr:
          description: "l\u2019acceptation des risques r\xE9siduels li\xE9s aux TIC\
            \ qui d\xE9passent le niveau de tol\xE9rance au risque de l\u2019entit\xE9\
            \ financi\xE8re vis\xE9 au point a);"
    - urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:3.d.ii.2
      assessable: true
      depth: 8
      parent_urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:3.d.ii
      ref_id: 3.d.ii.2
      description: for the review process referred to in point (iv) of this point
        (d);
      translations:
        fr:
          description: "le processus de r\xE9examen vis\xE9 au point iv) du pr\xE9\
            sent point d);"
    - urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:3.d.iii
      assessable: true
      depth: 7
      parent_urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:3.d
      ref_id: 3.d.iii
      description: the development of an inventory of the accepted residual ICT risks,
        including a justification for their acceptance;
      translations:
        fr:
          description: "l\u2019\xE9tablissement d\u2019un inventaire des risques r\xE9\
            siduels li\xE9s aux TIC qui ont \xE9t\xE9 accept\xE9s, accompagn\xE9 d\u2019\
            une justification de leur acceptation;"
    - urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:3.d.iv
      assessable: true
      depth: 7
      parent_urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:3.d
      ref_id: 3.d.iv
      description: 'provisions on the review of the accepted residual ICT risks at
        least once a year, including:'
      translations:
        fr:
          description: "des dispositions relatives au r\xE9examen, au moins une fois\
            \ par an, des risques r\xE9siduels li\xE9s aux TIC qui ont \xE9t\xE9 accept\xE9\
            s, comprenant:"
    - urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:3.d.iv.1
      assessable: true
      depth: 8
      parent_urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:3.d.iv
      ref_id: 3.d.iv.1
      description: the identification of any changes to the residual ICT risks;
      translations:
        fr:
          description: "l\u2019indication de tout changement dans les risques r\xE9\
            siduels li\xE9s aux TIC;"
    - urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:3.d.iv.2
      assessable: true
      depth: 8
      parent_urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:3.d.iv
      ref_id: 3.d.iv.2
      description: the assessment of available mitigation measures;
      translations:
        fr:
          description: "l\u2019\xE9valuation des mesures d\u2019att\xE9nuation disponibles;"
    - urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:3.d.iv.3
      assessable: true
      depth: 8
      parent_urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:3.d.iv
      ref_id: 3.d.iv.3
      description: the assessment of whether the reasons justifying the acceptance
        of residual ICT risks are still valid and applicable at the date of the review;
      translations:
        fr:
          description: "une \xE9valuation indiquant si les raisons justifiant l\u2019\
            acceptation des risques r\xE9siduels li\xE9s aux TIC sont toujours valables\
            \ et applicables \xE0 la date du r\xE9examen;"
    - urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:3.e
      assessable: true
      depth: 6
      parent_urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:article-3:1
      ref_id: 3.e
      description: 'provisions on the monitoring of:'
      translations:
        fr:
          description: "des dispositions qui pr\xE9voient le suivi:"
    - urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:3.e.i
      assessable: true
      depth: 7
      parent_urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:3.e
      ref_id: 3.e.i
      description: any changes to the ICT risk and cyber threat landscape;
      translations:
        fr:
          description: "de tout changement dans l\u2019\xE9ventail des risques li\xE9\
            s aux TIC et des cybermenaces;"
    - urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:3.e.ii
      assessable: true
      depth: 7
      parent_urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:3.e
      ref_id: 3.e.ii
      description: 'internal and external vulnerabilities and threats:'
      translations:
        fr:
          description: "des vuln\xE9rabilit\xE9s et menaces internes et externes;"
    - urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:3.e.iii
      assessable: true
      depth: 7
      parent_urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:3.e
      ref_id: 3.e.iii
      description: ICT risk of the financial entity that enables promp detection of
        changes that could affect its ICT risk profile;
      translations:
        fr:
          description: "du risque li\xE9 aux TIC de l\u2019entit\xE9 financi\xE8re,\
            \ et qui permettent de d\xE9tecter rapidement les changements susceptibles\
            \ d\u2019avoir une incidence sur son profil de risque li\xE9 aux TIC;"
    - urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:3.f
      assessable: true
      depth: 6
      parent_urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:article-3:1
      ref_id: 3.f
      description: provisions on a process to ensure that any changes to the business
        strategy and the digital operational resilience strategy of the financial
        entity are taken into account.
      translations:
        fr:
          description: "des dispositions relatives \xE0 un processus garantissant\
            \ la prise en compte de toute modification de la strat\xE9gie commerciale\
            \ et de la strat\xE9gie de r\xE9silience op\xE9rationnelle num\xE9rique\
            \ de l\u2019entit\xE9 financi\xE8re."
    - urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:article-3:2
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:article-3
      description: 'For the purposes of the first paragraph, point (c), the procedure
        referred to in that point shall ensure:'
      translations:
        fr:
          description: "La proc\xE9dure vis\xE9e au point c) du premier alin\xE9a\
            \ garantit, aux fins dudit point:"
    - urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:article-3:2:1
      assessable: true
      depth: 6
      parent_urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:article-3:2
      description: (a) the monitoring of the effectiveness of the ICT risk treatment
        measures implemented;
      translations:
        fr:
          description: "le suivi de l\u2019efficacit\xE9 des mesures de traitement\
            \ du risque li\xE9 aux TIC qui sont mises en \u0153uvre;"
    - urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:article-3:2:2
      assessable: true
      depth: 6
      parent_urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:article-3:2
      description: (b) the assessment of whether the established risk tolerance levels
        of the financial entity have been attained;
      translations:
        fr:
          description: "une \xE9valuation indiquant si les niveaux de tol\xE9rance\
            \ au risque \xE9tablis pour l\u2019entit\xE9 financi\xE8re ont \xE9t\xE9\
            \ atteints;"
    - urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:article-3:2:3
      assessable: true
      depth: 6
      parent_urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:article-3:2
      description: (c)the assessment of whether the financial entity has taken actions
        to correct or improve those measures where necessary.
      translations:
        fr:
          description: "une \xE9valuation indiquant si l\u2019entit\xE9 financi\xE8\
            re a pris, si n\xE9cessaire, des mesures pour corriger ou am\xE9liorer\
            \ ces mesures."
    - urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:section-3
      assessable: false
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:title-ii:1
      ref_id: SECTION 3
      description: ICT ASSET MANAGEMENT
      translations:
        fr:
          description: Gestion des actifs de TIC
    - urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:article-4
      assessable: false
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:section-3
      ref_id: Article 4
      description: ICT asset management policy
      translations:
        fr:
          description: Politique de gestion des actifs de TIC
    - urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:4.1
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:article-4
      ref_id: '4.1'
      description: As part of the ICT security policies, procedures, protocols, and
        tools referred to in Article 9(2) of Regulation (EU) 2022/2554, financial
        entities shall develop, document, and implement a policy on management of
        ICT assets.
      translations:
        fr:
          description: "Dans le cadre des politiques, proc\xE9dures, protocoles et\
            \ outils de s\xE9curit\xE9 des TIC vis\xE9s \xE0 l\u2019article 9, paragraphe\
            \ 2, du r\xE8glement (UE) 2022/2554, les entit\xE9s financi\xE8res \xE9\
            laborent, documentent et mettent en \u0153uvre une politique de gestion\
            \ des actifs de TIC."
    - urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:4.2
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:article-4
      ref_id: '4.2'
      description: 'The policy on management of ICT assets referred to in paragraph
        1 shall:'
      translations:
        fr:
          description: "La politique de gestion des actifs de TIC vis\xE9e au paragraphe\
            \ 1:"
    - urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:4.2.a
      assessable: true
      depth: 6
      parent_urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:4.2
      ref_id: 4.2.a
      description: prescribe the monitoring and management of the lifecycle of ICT
        assets identified and classified in accordance with Article 8(1) of Regulation
        (EU) 2022/2554;
      translations:
        fr:
          description: "prescrit le suivi et la gestion du cycle de vie des actifs\
            \ de TIC identifi\xE9s et class\xE9s conform\xE9ment \xE0 l\u2019article\
            \ 8, paragraphe 1, du r\xE8glement (UE) 2022/2554;"
    - urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:4.2.b
      assessable: true
      depth: 6
      parent_urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:4.2
      ref_id: 4.2.b
      description: 'prescribe that the financial entity keeps records of all of the
        following:'
      translations:
        fr:
          description: "prescrit la tenue par l\u2019entit\xE9 financi\xE8re d\u2019\
            un registre de tous les \xE9l\xE9ments suivants:"
    - urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:4.2.b.i
      assessable: true
      depth: 7
      parent_urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:4.2.b
      ref_id: 4.2.b.i
      description: the unique identifier of each ICT asset;
      translations:
        fr:
          description: "l\u2019identifiant unique de chaque actif de TIC;"
    - urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:4.2.b.ii
      assessable: true
      depth: 7
      parent_urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:4.2.b
      ref_id: 4.2.b.ii
      description: information on the location, either physical or logical, of all
        ICT assets;
      translations:
        fr:
          description: des informations sur la localisation, physique ou logique,
            de tous les actifs de TIC;
    - urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:4.2.b.iii
      assessable: true
      depth: 7
      parent_urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:4.2.b
      ref_id: 4.2.b.iii
      description: the classification of all ICT assets, as referred to in Article
        8(1) of Regulation (EU) 2022/2254;
      translations:
        fr:
          description: "le classement de tous les actifs de TIC, tel que pr\xE9vu\
            \ par l\u2019article 8, paragraphe 1, du r\xE8glement (UE) 2022/2254;"
    - urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:4.2.b.iv
      assessable: true
      depth: 7
      parent_urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:4.2.b
      ref_id: 4.2.b.iv
      description: the identity of ICT asset owners;
      translations:
        fr:
          description: "l\u2019identit\xE9 des propri\xE9taires d\u2019actifs de TIC;"
    - urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:4.2.b.v
      assessable: true
      depth: 7
      parent_urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:4.2.b
      ref_id: 4.2.b.v
      description: the business functions or services supported by the ICT asset;
      translations:
        fr:
          description: "les fonctions ou services \xABm\xE9tiers\xBB soutenus par\
            \ l\u2019actif de TIC;"
    - urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:4.2.b.vi
      assessable: true
      depth: 7
      parent_urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:4.2.b
      ref_id: 4.2.b.vi
      description: the ICT business continuity requirements, including recovery time
        objectives and recovery point objectives;
      translations:
        fr:
          description: "les exigences en mati\xE8re de continuit\xE9 des activit\xE9\
            s de TIC, notamment les objectifs en mati\xE8re de d\xE9lai de r\xE9tablissement\
            \ et de point de r\xE9tablissement;"
    - urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:4.2.b.vii
      assessable: true
      depth: 7
      parent_urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:4.2.b
      ref_id: 4.2.b.vii
      description: whether the ICT asset can be or is exposed to external networks,
        including the internet;
      translations:
        fr:
          description: "une mention pr\xE9cisant si l\u2019actif de TIC est ou peut\
            \ \xEAtre expos\xE9 \xE0 des r\xE9seaux externes, y compris l\u2019internet;"
    - urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:4.2.b.viii
      assessable: true
      depth: 7
      parent_urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:4.2.b
      ref_id: 4.2.b.viii
      description: the links and interdependencies among ICT assets and the business
        functions using each ICT asset;
      translations:
        fr:
          description: "les liens et interd\xE9pendances existant entre les actifs\
            \ de TIC et les fonctions \xABm\xE9tiers\xBB qui utilisent chacun de ces\
            \ actifs;"
    - urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:4.2.b.ix
      assessable: true
      depth: 7
      parent_urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:4.2.b
      ref_id: 4.2.b.ix
      description: "where applicable, for all ICT assets, the end dates of the ICT\
        \ third-party service provider\u2019s regular, extended, and custom support\
        \ services after which those ICT assets are no longer supported by their supplier\
        \ or by an ICT third-party service provider;"
      translations:
        fr:
          description: "le cas \xE9ch\xE9ant, pour tous les actifs de TIC, les dates\
            \ d\u2019expiration des services d\u2019appui r\xE9guliers, \xE9tendus\
            \ et sur mesure fournis par des prestataires tiers de services TIC, apr\xE8\
            s lesquelles ces actifs de TIC ne sont plus pris en charge par leur fournisseur\
            \ ou par un prestataire tiers de services TIC;"
    - urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:4.2.c
      assessable: true
      depth: 6
      parent_urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:4.2
      ref_id: 4.2.c
      description: for financial entities other than microenterprises, prescribe that
        those financial entities keep records of the information necessary to perform
        a specific ICT risk assessment on all legacy ICT systems referred to in Article
        8(7) of Regulation (EU) 2022/2554.
      translations:
        fr:
          description: "prescrit la tenue, par les entit\xE9s financi\xE8res autres\
            \ que des microentreprises, d\u2019un registre des informations n\xE9\
            cessaires pour proc\xE9der \xE0 l\u2019\xE9valuation sp\xE9cifique du\
            \ risque li\xE9 aux TIC sur tous les syst\xE8mes de TIC h\xE9rit\xE9s\
            \ pr\xE9vue par l\u2019article 8, paragraphe 7, du r\xE8glement (UE) 2022/2554."
    - urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:article-5
      assessable: false
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:section-3
      ref_id: Article 5
      description: ICT asset management procedure
      translations:
        fr:
          description: "Proc\xE9dure de gestion des actifs de TIC"
    - urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:5.1
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:article-5
      ref_id: '5.1'
      description: Financial entities shall develop, document, and implement a procedure
        for the management of ICT assets.
      translations:
        fr:
          description: "Les entit\xE9s financi\xE8res \xE9laborent, documentent et\
            \ mettent en \u0153uvre une proc\xE9dure de gestion des actifs de TIC."
    - urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:5.2
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:article-5
      ref_id: '5.2'
      description: 'The procedure for management of ICT assets referred to in paragraph
        1 shall specify the criteria to perform the criticality assessment of information
        assets and ICT assets supporting business functions. That assessment shall
        take into account:'
      translations:
        fr:
          description: "La proc\xE9dure de gestion des actifs de TIC vis\xE9e au paragraphe\
            \ 1 pr\xE9cise les crit\xE8res utilis\xE9s pour proc\xE9der \xE0 l\u2019\
            \xE9valuation de la criticit\xE9 des actifs d\u2019information et des\
            \ actifs de TIC soutenant des fonctions \xABm\xE9tiers\xBB. Cette \xE9\
            valuation tient compte:"
    - urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:5.2.a
      assessable: true
      depth: 6
      parent_urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:5.2
      ref_id: 5.2.a
      description: the ICT risk related to those business functions and their dependencies
        on the information assets or ICT assets;
      translations:
        fr:
          description: "du risque li\xE9 aux TIC associ\xE9 \xE0 ces fonctions \xAB\
            m\xE9tiers\xBB et de leur d\xE9pendance \xE0 l\u2019\xE9gard des actifs\
            \ d\u2019information ou des actifs de TIC;"
    - urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:5.2.b
      assessable: true
      depth: 6
      parent_urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:5.2
      ref_id: 5.2.b
      description: how the loss of confidentiality, integrity, and availability of
        such information assets and ICT assets would impact the business processes
        and activities of the financial entities.
      translations:
        fr:
          description: "de l\u2019incidence que la perte de confidentialit\xE9, d\u2019\
            int\xE9grit\xE9 et de disponibilit\xE9 de ces actifs d\u2019information\
            \ et actifs de TIC aurait sur les processus op\xE9rationnels et les activit\xE9\
            s des entit\xE9s financi\xE8res."
    - urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:section-4
      assessable: false
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:title-ii:1
      ref_id: SECTION 4
      description: ENCRYPTION AND CRYPTOGRAPHY
      translations:
        fr:
          description: Chiffrement et cryptographie
    - urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:article-6
      assessable: false
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:section-4
      ref_id: Article 6
      description: Encryption and cryptographic controls
      translations:
        fr:
          description: "Chiffrement et contr\xF4les cryptographiques"
    - urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:6.1
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:article-6
      ref_id: '6.1'
      description: As part of their ICT security policies, procedures, protocols,
        and tools referred to in Article 9(2) of Regulation (EU) 2022/2554, financial
        entities shall develop, document, and implement a policy on encryption and
        cryptographic controls.
      translations:
        fr:
          description: "Dans le cadre de leurs politiques, proc\xE9dures, protocoles\
            \ et outils de s\xE9curit\xE9 de TIC vis\xE9s \xE0 l\u2019article 9, paragraphe\
            \ 2, du r\xE8glement (UE) 2022/2554, les entit\xE9s financi\xE8res \xE9\
            laborent, documentent et mettent en \u0153uvre une politique en mati\xE8\
            re de chiffrement et de contr\xF4les cryptographiques."
    - urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:6.2
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:article-6
      ref_id: '6.2'
      description: 'Financial entities shall design the policy on encryption and cryptographic
        controls referred to in paragraph 1 on the basis of the results of an approved
        data classification and ICT risk assessment. That policy shall contain rules
        for all of the following:'
      translations:
        fr:
          description: "Les entit\xE9s financi\xE8res con\xE7oivent la politique en\
            \ mati\xE8re de chiffrement et de contr\xF4les cryptographiques vis\xE9\
            e au paragraphe 1 sur la base des r\xE9sultats d\u2019une classification\
            \ des donn\xE9es approuv\xE9e et de l\u2019\xE9valuation du risque li\xE9\
            \ aux TIC. Cette politique contient des r\xE8gles pour tous les \xE9l\xE9\
            ments suivants:"
    - urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:6.2.a
      assessable: true
      depth: 6
      parent_urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:6.2
      ref_id: 6.2.a
      description: the encryption of data at rest and in transit;
      translations:
        fr:
          description: "le chiffrement des donn\xE9es au repos et en transit;"
    - urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:6.2.b
      assessable: true
      depth: 6
      parent_urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:6.2
      ref_id: 6.2.b
      description: the encryption of data in use, where necessary;
      translations:
        fr:
          description: "le chiffrement des donn\xE9es en cours d\u2019utilisation,\
            \ si n\xE9cessaire;"
    - urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:6.2.c
      assessable: true
      depth: 6
      parent_urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:6.2
      ref_id: 6.2.c
      description: the encryption of internal network connections and traffic with
        external parties;
      translations:
        fr:
          description: "le chiffrement des connexions internes au r\xE9seau et du\
            \ trafic avec des tiers;"
    - urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:6.2.d
      assessable: true
      depth: 6
      parent_urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:6.2
      ref_id: 6.2.d
      description: the cryptographic key management referred to in Article 7, laying
        down rules on the correct use, protection, and lifecycle of cryptographic
        keys.
      translations:
        fr:
          description: "la gestion des cl\xE9s cryptographiques vis\xE9e \xE0 l\u2019\
            article 7, y compris des r\xE8gles relatives \xE0 la bonne utilisation,\
            \ \xE0 la protection et au cycle de vie des cl\xE9s cryptographiques."
    - urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:article-6:1
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:article-6
      description: For the purposes of point (b), where encryption of data in use
        is not possible, financial entities shall process data in use in a separated
        and protected environment, or take equivalent measures to ensure the confidentiality,
        integrity, authenticity, and availability of data.
      translations:
        fr:
          description: "Aux fins du point b), lorsque le chiffrement des donn\xE9\
            es en cours d\u2019utilisation n\u2019est pas possible, les entit\xE9\
            s financi\xE8res traitent ces donn\xE9es dans un environnement s\xE9par\xE9\
            \ et prot\xE9g\xE9, ou prennent des mesures \xE9quivalentes pour garantir\
            \ la confidentialit\xE9, l\u2019int\xE9grit\xE9, l\u2019authenticit\xE9\
            \ et la disponibilit\xE9 des donn\xE9es."
    - urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:6.3
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:article-6
      ref_id: '6.3'
      description: Financial entities shall include in the policy on encryption and
        cryptographic controls referred to in paragraph 1 criteria for the selection
        of cryptographic techniques and use practices, taking into account leading
        practices, and standards as defined in Article 2, point (1), of Regulation
        (EU) No 1025/2012, and the classification of relevant ICT assets established
        in accordance with Article 8(1) of Regulation (EU) 2022/2554. Financial entities
        that are not able to adhere to the leading practices or standards, or to use
        the most reliable techniques, shall adopt mitigation and monitoring measures
        that ensure resilience against cyber threats.
      translations:
        fr:
          description: "Les entit\xE9s financi\xE8res incluent dans la politique en\
            \ mati\xE8re de chiffrement et de contr\xF4les cryptographiques vis\xE9\
            e au paragraphe 1 des crit\xE8res de s\xE9lection des techniques cryptographiques\
            \ et des pratiques d\u2019utilisation, tenant compte des pratiques de\
            \ pointe, ainsi que des normes d\xE9finies \xE0 l\u2019article 2, point\
            \ 1), du r\xE8glement (UE) no 1025/2012, et de la classification des actifs\
            \ de TIC concern\xE9s effectu\xE9e conform\xE9ment \xE0 l\u2019article\
            \ 8, paragraphe 1, du r\xE8glement (UE) 2022/2554. Les entit\xE9s financi\xE8\
            res qui ne sont pas en mesure d\u2019appliquer les pratiques de pointe\
            \ ou les normes, ou d\u2019utiliser les techniques les plus fiables, adoptent\
            \ des mesures d\u2019att\xE9nuation et de suivi qui garantissent la r\xE9\
            silience face aux cybermenaces."
    - urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:6.4
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:article-6
      ref_id: '6.4'
      description: Financial entities shall include in the policy on encryption and
        cryptographic controls referred to in paragraph 1 provisions for updating
        or changing, where necessary, the cryptographic technology on the basis of
        developments in cryptanalysis. Those updates or changes shall ensure that
        the cryptographic technology remains resilient against cyber threats, as required
        by Article 10(2), point (a). Financial entities that are not able to update
        or change the cryptographic technology shall adopt mitigation and monitoring
        measures that ensure resilience against cyber threats.
      translations:
        fr:
          description: "Les entit\xE9s financi\xE8res incluent dans la politique en\
            \ mati\xE8re de chiffrement et de contr\xF4les cryptographiques vis\xE9\
            e au paragraphe 1 des dispositions relatives \xE0 la mise \xE0 jour ou\
            \ \xE0 la modification, si n\xE9cessaire, de la technologie cryptographique,\
            \ en fonction de l\u2019\xE9volution de la cryptanalyse. Ces mises \xE0\
            \ jour ou modifications garantissent que la technologie cryptographique\
            \ reste r\xE9siliente face aux cybermenaces, comme l\u2019exige l\u2019\
            article 10, paragraphe 2, point a). Les entit\xE9s financi\xE8res qui\
            \ ne sont pas en mesure de mettre \xE0 jour ou de modifier la technologie\
            \ cryptographique adoptent des mesures d\u2019att\xE9nuation et de suivi\
            \ qui garantissent la r\xE9silience face aux cybermenaces."
    - urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:6.5
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:article-6
      ref_id: '6.5'
      description: Financial entities shall include in the policy on encryption and
        cryptographic controls referred to in paragraph 1 a requirement to record
        the adoption of mitigation and monitoring measures adopted in accordance with
        paragraphs 3 and 4 and to provide a reasoned explanation for doing so.
      translations:
        fr:
          description: "Les entit\xE9s financi\xE8res incluent dans la politique en\
            \ mati\xE8re de chiffrement et de contr\xF4les cryptographiques vis\xE9\
            e au paragraphe 1 l\u2019obligation d\u2019enregistrer l\u2019adoption\
            \ des mesures d\u2019att\xE9nuation et de suivi adopt\xE9es conform\xE9\
            ment aux paragraphes 3 et 4 et de fournir une explication motiv\xE9e des\
            \ raisons pour lesquelles elles proc\xE8dent ainsi."
    - urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:article-7
      assessable: false
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:section-4
      ref_id: Article 7
      description: Cryptographic key management
      translations:
        fr:
          description: "Gestion des cl\xE9s cryptographiques"
    - urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:7.1
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:article-7
      ref_id: '7.1'
      description: Financial entities shall include in the cryptographic key management
        policy referred to in Article 6(2), point (d), requirements for managing cryptographic
        keys through their whole lifecycle, including generating, renewing, storing,
        backing up, archiving, retrieving, transmitting, retiring, revoking, and destroying
        those cryptographic keys.
      translations:
        fr:
          description: "Les entit\xE9s financi\xE8res incluent dans la politique de\
            \ gestion des cl\xE9s cryptographiques vis\xE9e \xE0 l\u2019article 6,\
            \ paragraphe 2, point d), des exigences relatives \xE0 la gestion des\
            \ cl\xE9s cryptographiques tout au long de leur cycle de vie, notamment\
            \ en ce qui concerne la g\xE9n\xE9ration, le renouvellement, le stockage,\
            \ la sauvegarde, l\u2019archivage, la r\xE9cup\xE9ration, la transmission,\
            \ le retrait, la r\xE9vocation et la destruction de ces cl\xE9s cryptographiques."
    - urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:7.2
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:article-7
      ref_id: '7.2'
      description: Financial entities shall identify and implement controls to protect
        cryptographic keys through their whole lifecycle against loss, unauthorised
        access, disclosure, and modification. Financial entities shall design those
        controls on the basis of the results of the approved data classification and
        the ICT risk assessment.
      translations:
        fr:
          description: "Les entit\xE9s financi\xE8res d\xE9finissent et mettent en\
            \ \u0153uvre des contr\xF4les visant \xE0 prot\xE9ger les cl\xE9s cryptographiques\
            \ tout au long de leur cycle de vie contre la perte, les acc\xE8s non\
            \ autoris\xE9s, la divulgation et la modification. Les entit\xE9s financi\xE8\
            res con\xE7oivent ces contr\xF4les sur la base des r\xE9sultats de la\
            \ classification des donn\xE9es approuv\xE9e et de l\u2019\xE9valuation\
            \ du risque li\xE9 aux TIC."
    - urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:7.3
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:article-7
      ref_id: '7.3'
      description: Financial entities shall develop and implement methods to replace
        the cryptographic keys in the case of loss, or where those keys are compromised
        or damaged.
      translations:
        fr:
          description: "Les entit\xE9s financi\xE8res \xE9laborent et mettent en \u0153\
            uvre des m\xE9thodes pour remplacer les cl\xE9s cryptographiques en cas\
            \ de perte ou lorsque ces cl\xE9s sont compromises ou endommag\xE9es."
    - urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:7.4
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:article-7
      ref_id: '7.4'
      description: Financial entities shall create and maintain a register for all
        certificates and certificate-storing devices for at least ICT assets supporting
        critical or important functions. Financial entities shall keep that register
        up to date
      translations:
        fr:
          description: "Les entit\xE9s financi\xE8res cr\xE9ent et tiennent un registre\
            \ de tous les certificats et dispositifs de stockage de certificats pour\
            \ au moins les actifs de TIC qui soutiennent des fonctions critiques ou\
            \ importantes. Les entit\xE9s financi\xE8res tiennent ce registre \xE0\
            \ jour."
    - urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:7.5
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:article-7
      ref_id: '7.5'
      description: Financial entities shall ensure the prompt renewal of certificates
        in advance of their expiration.
      translations:
        fr:
          description: "Les entit\xE9s financi\xE8res veillent au renouvellement en\
            \ temps utile des certificats avant leur expiration."
    - urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:section-5
      assessable: false
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:title-ii:1
      ref_id: SECTION 5
      description: ICT OPERATIONS SECURITY
      translations:
        fr:
          description: "S\xE9curit\xE9 des op\xE9rations de TIC"
    - urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:article-8
      assessable: false
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:section-5
      ref_id: Article 8
      description: Policies and procedures for ICT operations
      translations:
        fr:
          description: "Politiques et proc\xE9dures pour les op\xE9rations de TIC"
    - urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:8.1
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:article-8
      ref_id: '8.1'
      description: As part of the ICT security policies, procedures, protocols, and
        tools referred to in Article 9(2) of Regulation (EU) 2022/2554, financial
        entities shall develop, document, and implement policies and procedures to
        manage the ICT operations. Those policies and procedures shall specify how
        financial entities operate, monitor, control, and restore their ICT assets,
        including the documentation of ICT operations.
      translations:
        fr:
          description: "Dans le cadre des politiques, proc\xE9dures, protocoles et\
            \ outils de s\xE9curit\xE9 des TIC vis\xE9s \xE0 l\u2019article 9, paragraphe\
            \ 2, du r\xE8glement (UE) 2022/2554, les entit\xE9s financi\xE8res \xE9\
            laborent, documentent et mettent en \u0153uvre des politiques et des proc\xE9\
            dures pour g\xE9rer les op\xE9rations de TIC. Ces politiques et proc\xE9\
            dures pr\xE9cisent la mani\xE8re dont les entit\xE9s financi\xE8res g\xE8\
            rent, suivent, contr\xF4lent et restaurent leurs actifs de TIC, y compris\
            \ la documentation relative aux op\xE9rations de TIC."
    - urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:8.2
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:article-8
      ref_id: '8.2'
      description: 'The policies and procedures for ICT operations referred to in
        paragraph 1 shall

        contain all of the following:'
      translations:
        fr:
          description: "Les politiques et proc\xE9dures relatives aux op\xE9rations\
            \ de TIC vis\xE9es au paragraphe 1 contiennent l\u2019ensemble des \xE9\
            l\xE9ments suivants:"
    - urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:8.2.a
      assessable: true
      depth: 6
      parent_urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:8.2
      ref_id: 8.2.a
      description: 'an ICT assets description, including all of the following:'
      translations:
        fr:
          description: "une description des actifs de TIC, comprenant l\u2019ensemble\
            \ des \xE9l\xE9ments suivants:"
    - urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:8.2.a.i
      assessable: true
      depth: 7
      parent_urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:8.2.a
      ref_id: 8.2.a.i
      description: requirements regarding secure installation, maintenance, configuration,
        and deinstallation of an ICT system;
      translations:
        fr:
          description: "des exigences relatives \xE0 la s\xE9curit\xE9 de l\u2019\
            installation, de la maintenance, de la configuration et de la d\xE9sinstallation\
            \ d\u2019un syst\xE8me de TIC;"
    - urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:8.2.a.ii
      assessable: true
      depth: 7
      parent_urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:8.2.a
      ref_id: 8.2.a.ii
      description: requirements regarding the management of information assets used
        by ICT assets, including their processing and handling, both automated and
        manual;
      translations:
        fr:
          description: "des exigences relatives \xE0 la gestion des actifs informationnels\
            \ utilis\xE9s par les actifs de TIC, y compris leur traitement et leur\
            \ gestion, tant automatis\xE9s que manuels;"
    - urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:8.2.a.iii
      assessable: true
      depth: 7
      parent_urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:8.2.a
      ref_id: 8.2.a.iii
      description: requirements regarding the identification and control of legacy
        ICT systems;
      translations:
        fr:
          description: "des exigences relatives \xE0 l\u2019identification et au contr\xF4\
            le des syst\xE8mes de TIC h\xE9rit\xE9s;"
    - urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:8.2.b
      assessable: true
      depth: 6
      parent_urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:8.2
      ref_id: 8.2.b
      description: 'controls and monitoring of ICT systems, including all of the following:'
      translations:
        fr:
          description: "des contr\xF4les et un suivi des syst\xE8mes de TIC, comprenant\
            \ l\u2019ensemble des \xE9l\xE9ments suivants:"
    - urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:8.2.b.i
      assessable: true
      depth: 7
      parent_urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:8.2.b
      ref_id: 8.2.b.i
      description: backup and restore requirements of ICT systems;
      translations:
        fr:
          description: "des exigences de sauvegarde et de restauration des syst\xE8\
            mes de TIC;"
    - urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:8.2.b.ii
      assessable: true
      depth: 7
      parent_urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:8.2.b
      ref_id: 8.2.b.ii
      description: scheduling requirements, taking into consideration interdependencies
        among the ICT systems;
      translations:
        fr:
          description: "des exigences de programmation dans le temps, tenant compte\
            \ des interd\xE9pendances entre les syst\xE8mes de TIC;"
    - urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:8.2.b.iii
      assessable: true
      depth: 7
      parent_urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:8.2.b
      ref_id: 8.2.b.iii
      description: protocols for audit-trail and system log information;
      translations:
        fr:
          description: "des protocoles pour les informations de la piste d\u2019audit\
            \ et du journal du syst\xE8me;"
    - urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:8.2.b.iv
      assessable: true
      depth: 7
      parent_urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:8.2.b
      ref_id: 8.2.b.iv
      description: requirements to ensure that the performance of internal audit and
        other testing minimises disruptions to business operations;
      translations:
        fr:
          description: "des exigences visant \xE0 garantir que la r\xE9alisation d\u2019\
            audits internes et d\u2019autres tests perturbe le moins possible les\
            \ activit\xE9s;"
    - urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:8.2.b.v
      assessable: true
      depth: 7
      parent_urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:8.2.b
      ref_id: 8.2.b.v
      description: requirements on the separation of ICT production environments from
        the development, testing, and other non-production environments;
      translations:
        fr:
          description: "des exigences relatives \xE0 la s\xE9paration entre les environnements\
            \ de production des TIC, d\u2019une part, et les environnements de d\xE9\
            veloppement, de tests et les autres environnements hors production, d\u2019\
            autre part;"
    - urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:8.2.b.vi
      assessable: true
      depth: 7
      parent_urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:8.2.b
      ref_id: 8.2.b.vi
      description: requirements to conduct the development and testing in environments
        which are separated from the production environment;
      translations:
        fr:
          description: "des exigences imposant que le d\xE9veloppement et les tests\
            \ aient lieu dans des environnements s\xE9par\xE9s de l\u2019environnement\
            \ de production;"
    - urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:8.2.b.vii
      assessable: true
      depth: 7
      parent_urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:8.2.b
      ref_id: 8.2.b.vii
      description: requirements to conduct the development and testing in production
        environments;
      translations:
        fr:
          description: "les exigences \xE0 respecter pour d\xE9velopper et tester\
            \ en environnement de production;"
    - urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:8.2.c
      assessable: true
      depth: 6
      parent_urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:8.2
      ref_id: 8.2.c
      description: 'error handling concerning ICT systems, including all of the following:'
      translations:
        fr:
          description: "le traitement des erreurs concernant les syst\xE8mes de TIC,\
            \ comprenant l\u2019ensemble des \xE9l\xE9ments suivants:"
    - urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:8.2.c.i
      assessable: true
      depth: 7
      parent_urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:8.2.c
      ref_id: 8.2.c.i
      description: procedures and protocols for handling errors;
      translations:
        fr:
          description: "des proc\xE9dures et protocoles de traitement des erreurs;"
    - urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:8.2.c.ii
      assessable: true
      depth: 7
      parent_urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:8.2.c
      ref_id: 8.2.c.ii
      description: support and escalation contacts, including external support contacts
        in case of unexpected operational or technical issues;
      translations:
        fr:
          description: "les interlocuteurs \xE0 contacter pour un appui technique\
            \ et la remont\xE9e d\u2019informations, y compris les interlocuteurs\
            \ \xE0 contacter pour un appui technique externe en cas de probl\xE8mes\
            \ op\xE9rationnels ou techniques impr\xE9vus;"
    - urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:8.2.c.iii
      assessable: true
      depth: 7
      parent_urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:8.2.c
      ref_id: 8.2.c.iii
      description: ICT system restart, rollback, and recovery procedures for use in
        the event of ICT system disruption.
      translations:
        fr:
          description: "les proc\xE9dures de red\xE9marrage, de reprise et de r\xE9\
            tablissement des syst\xE8mes de TIC \xE0 appliquer en cas de dysfonctionnement\
            \ des syst\xE8mes de TIC."
    - urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:article-8:1
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:article-8
      description: For the purposes of point (b)(v), the separation shall consider
        all of the components of the environment, including accounts, data or connections,
        as required by Article 13(1), point (a)
      translations:
        fr:
          description: "Aux fins du point b) v), la s\xE9paration tient compte de\
            \ toutes les composantes de l\u2019environnement, notamment des comptes,\
            \ donn\xE9es ou connexions, comme l\u2019exige l\u2019article 13, paragraphe\
            \ 1, point a)."
    - urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:article-8:2
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:article-8
      description: For the purposes of point (b)(vii), the policies and procedures
        referred to in paragraph 1 shall provide that the instances in which testing
        is performed in a production environment are clearly identified, reasoned,
        are for limited periods of time, and are approved by the relevant function
        in accordance with Article 16(6). Financial entities shall ensure the availability,
        confidentiality, integrity, and authenticity of ICT systems and production
        data during development and test activities in the production environment.
      translations:
        fr:
          description: "Aux fins du point b) vii), les politiques et proc\xE9dures\
            \ vis\xE9es au paragraphe 1 pr\xE9voient que les cas de r\xE9alisation\
            \ de tests dans un environnement de production soient clairement identifi\xE9\
            s et motiv\xE9s, d\u2019une dur\xE9e limit\xE9e et approuv\xE9s par la\
            \ fonction comp\xE9tente conform\xE9ment \xE0 l\u2019article 16, paragraphe\
            \ 6. Les entit\xE9s financi\xE8res garantissent la disponibilit\xE9, la\
            \ confidentialit\xE9, l\u2019int\xE9grit\xE9 et l\u2019authenticit\xE9\
            \ des syst\xE8mes de TIC et des donn\xE9es de production lors des activit\xE9\
            s de d\xE9veloppement et de test dans l\u2019environnement de production."
    - urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:article-9
      assessable: false
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:section-5
      ref_id: Article 9
      description: Capacity and performance management
      translations:
        fr:
          description: "Gestion des capacit\xE9s et des performances"
    - urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:9.1
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:article-9
      ref_id: '9.1'
      description: 'As part of the ICT security policies, procedures, protocols, and
        tools referred to in Article 9(2) of Regulation (EU) 2022/2554, financial
        entities shall develop, document, and implement capacity and performance management
        procedures for the following:'
      translations:
        fr:
          description: "Dans le cadre des politiques, proc\xE9dures, protocoles et\
            \ outils de s\xE9curit\xE9 des TIC vis\xE9s \xE0 l\u2019article 9, paragraphe\
            \ 2, du r\xE8glement (UE) 2022/2554, les entit\xE9s financi\xE8res \xE9\
            laborent, documentent et mettent en \u0153uvre des proc\xE9dures de gestion\
            \ des capacit\xE9s et des performances pour:"
    - urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:9.1.a
      assessable: true
      depth: 6
      parent_urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:9.1
      ref_id: 9.1.a
      description: the identification of capacity requirements of their ICT systems;
      translations:
        fr:
          description: "l\u2019identification des besoins en capacit\xE9s de leurs\
            \ syst\xE8mes de TIC;"
    - urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:9.1.b
      assessable: true
      depth: 6
      parent_urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:9.1
      ref_id: 9.1.b
      description: the application of resource optimisation;
      translations:
        fr:
          description: "la mise en \u0153uvre de l\u2019optimisation des ressources;"
    - urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:9.1.c
      assessable: true
      depth: 6
      parent_urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:9.1
      ref_id: 9.1.c
      description: 'the monitoring procedures for maintaining and improving:'
      translations:
        fr:
          description: "les proc\xE9dures de suivi visant \xE0 maintenir et \xE0 am\xE9\
            liorer:"
    - urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:9.1.c.i
      assessable: true
      depth: 7
      parent_urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:9.1.c
      ref_id: 9.1.c.i
      description: the availability of data and ICT systems;
      translations:
        fr:
          description: "la disponibilit\xE9 des donn\xE9es et des syst\xE8mes de TIC;"
    - urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:9.1.c.ii
      assessable: true
      depth: 7
      parent_urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:9.1.c
      ref_id: 9.1.c.ii
      description: the efficiency of ICT systems;
      translations:
        fr:
          description: "l\u2019efficience des syst\xE8mes de TIC;"
    - urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:9.1.c.iii
      assessable: true
      depth: 7
      parent_urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:9.1.c
      ref_id: 9.1.c.iii
      description: the prevention of ICT capacity shortages.
      translations:
        fr:
          description: "la pr\xE9vention des d\xE9ficits de capacit\xE9s en mati\xE8\
            re de TIC."
    - urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:9.2
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:article-9
      ref_id: '9.2'
      description: The capacity and performance management procedures referred to
        in paragraph 1 shall ensure that financial entities take measures that are
        appropriate to cater for the specificities of ICT systems with long or complex
        procurement or approval processes or ICT systems that are resource-intensive.
      translations:
        fr:
          description: "Les proc\xE9dures de gestion des capacit\xE9s et des performances\
            \ vis\xE9es au paragraphe 1 garantissent que les entit\xE9s financi\xE8\
            res prennent des mesures ad\xE9quates pour tenir compte des sp\xE9cificit\xE9\
            s des syst\xE8mes de TIC soumis \xE0 des processus de passation de march\xE9\
            s ou d\u2019approbation longs ou complexes ou des syst\xE8mes de TIC qui\
            \ requi\xE8rent des ressources importantes."
    - urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:article-10
      assessable: false
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:section-5
      ref_id: Article 10
      description: Vulnerability and patch management
      translations:
        fr:
          description: "Gestion des vuln\xE9rabilit\xE9s et des correctifs"
    - urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:10.1
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:article-10
      ref_id: '10.1'
      description: As part of the ICT security policies, procedures, protocols, and
        tools referred to in Article 9(2) of Regulation (EU) 2022/2554, financial
        entities shall develop, document, and implement vulnerability management procedures.
      translations:
        fr:
          description: "Dans le cadre des politiques, proc\xE9dures, protocoles et\
            \ outils de s\xE9curit\xE9 des TIC vis\xE9s \xE0 l\u2019article 9, paragraphe\
            \ 2, du r\xE8glement (UE) 2022/2554, les entit\xE9s financi\xE8res \xE9\
            laborent, documentent et mettent en \u0153uvre des proc\xE9dures de gestion\
            \ des vuln\xE9rabilit\xE9s."
    - urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:10.2
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:article-10
      ref_id: '10.2'
      description: 'The vulnerability management procedures referred to in paragraph
        1 shall:'
      translations:
        fr:
          description: "Les proc\xE9dures de gestion des vuln\xE9rabilit\xE9s vis\xE9\
            es au paragraphe 1:"
    - urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:10.2.a
      assessable: true
      depth: 6
      parent_urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:10.2
      ref_id: 10.2.a
      description: identify and update relevant and trustworthy information resources
        to build and maintain awareness about vulnerabilities;
      translations:
        fr:
          description: "identifient et tiennent \xE0 jour des ressources d\u2019information\
            \ pertinentes et fiables pour renforcer et maintenir la sensibilisation\
            \ aux vuln\xE9rabilit\xE9s;"
    - urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:10.2.b
      assessable: true
      depth: 6
      parent_urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:10.2
      ref_id: 10.2.b
      description: ensure the performance of automated vulnerability scanning and
        assessments on ICT assets, whereby the frequency and scope of those activities
        shall be commensurate to the classification established in accordance with
        Article 8(1) of Regulation (EU) 2022/2554 and the overall risk profile of
        the ICT asset;
      translations:
        fr:
          description: "pr\xE9voient des scans et \xE9valuations automatis\xE9s des\
            \ vuln\xE9rabilit\xE9s des actifs de TIC, la fr\xE9quence et le champ\
            \ d\u2019application de ces activit\xE9s \xE9tant proportionn\xE9s \xE0\
            \ la classification \xE9tablie conform\xE9ment \xE0 l\u2019article 8,\
            \ paragraphe 1, du r\xE8glement (UE) 2022/2554 et au profil de risque\
            \ global de l\u2019actif de TIC;"
    - urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:10.2.c
      assessable: true
      depth: 6
      parent_urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:10.2
      ref_id: 10.2.c
      description: 'verify whether:'
      translations:
        fr:
          description: "v\xE9rifient:"
    - urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:10.2.c.i
      assessable: true
      depth: 7
      parent_urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:10.2.c
      ref_id: 10.2.c.i
      description: ICT third-party service providers handle vulnerabilities related
        to the ICT services provided to the financial entity;
      translations:
        fr:
          description: "si les prestataires tiers de services TIC traitent les vuln\xE9\
            rabilit\xE9s li\xE9es aux services TIC fournis \xE0 l\u2019entit\xE9 financi\xE8\
            re;"
    - urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:10.2.c.ii
      assessable: true
      depth: 7
      parent_urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:10.2.c
      ref_id: 10.2.c.ii
      description: whether those service providers report to the financial entity
        at least the critical vulnerabilities and statistics and trends in a timely
        manner;
      translations:
        fr:
          description: "si ces prestataires de services informent l\u2019entit\xE9\
            \ financi\xE8re, en temps utile, au moins des vuln\xE9rabilit\xE9s critiques,\
            \ ainsi que des statistiques et tendances;"
    - urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:10.2.d
      assessable: true
      depth: 6
      parent_urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:10.2
      ref_id: 10.2.d
      description: 'track the usage of:'
      translations:
        fr:
          description: "tracent l\u2019utilisation:"
    - urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:10.2.d.i
      assessable: true
      depth: 7
      parent_urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:10.2.d
      ref_id: 10.2.d.i
      description: third-party libraries, including open-source libraries, used by
        ICT services supporting critical or important functions;
      translations:
        fr:
          description: "de biblioth\xE8ques tierces, y compris de biblioth\xE8ques\
            \ \xE0 code source ouvert, utilis\xE9es par les services TIC qui soutiennent\
            \ des fonctions critiques ou importantes;"
    - urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:10.2.d.ii
      assessable: true
      depth: 7
      parent_urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:10.2.d
      ref_id: 10.2.d.ii
      description: ICT services developed by the financial entity itself or specifically
        customised or developed for the financial entity by an ICT third-party service
        provider;
      translations:
        fr:
          description: "de services TIC d\xE9velopp\xE9s par l\u2019entit\xE9 financi\xE8\
            re elle-m\xEAme, ou sp\xE9cifiquement adapt\xE9s ou d\xE9velopp\xE9s pour\
            \ elle par un prestataire tiers de services TIC;"
    - urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:10.2.e
      assessable: true
      depth: 6
      parent_urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:10.2
      ref_id: 10.2.e
      description: establish procedures for the responsible disclosure of vulnerabilities
        to clients, counterparties, and to the public;
      translations:
        fr:
          description: "\xE9tablissent des proc\xE9dures pour une divulgation responsable\
            \ des vuln\xE9rabilit\xE9s aux clients, aux contreparties et au public;"
    - urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:10.2.f
      assessable: true
      depth: 6
      parent_urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:10.2
      ref_id: 10.2.f
      description: 'prioritise the deployment of patches and other mitigation measures
        to address

        the vulnerabilities identified;'
      translations:
        fr:
          description: "donnent la priorit\xE9 au d\xE9ploiement de correctifs et\
            \ d\u2019autres mesures d\u2019att\xE9nuation pour rem\xE9dier aux vuln\xE9\
            rabilit\xE9s d\xE9cel\xE9es;"
    - urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:10.2.g
      assessable: true
      depth: 6
      parent_urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:10.2
      ref_id: 10.2.g
      description: monitor and verify the remediation of vulnerabilities;
      translations:
        fr:
          description: "suivent et v\xE9rifient la correction des vuln\xE9rabilit\xE9\
            s;"
    - urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:10.2.h
      assessable: true
      depth: 6
      parent_urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:10.2
      ref_id: 10.2.h
      description: require the recording of any detected vulnerabilities affecting
        ICT systems and the monitoring of their resolution.
      translations:
        fr:
          description: "exigent l\u2019enregistrement de toute vuln\xE9rabilit\xE9\
            \ d\xE9tect\xE9e touchant les syst\xE8mes de TIC et le suivi de leur r\xE9\
            solution."
    - urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:article-10:1
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:article-10
      description: For the purposes of point (b), financial entities shall perform
        the automated vulnerability scanning and assessments on ICT assets for the
        ICT assets supporting critical or important functions on at least a weekly
        basis.
      translations:
        fr:
          description: "Aux fins du point b), les entit\xE9s financi\xE8res effectuent\
            \ au moins une fois par semaine les scans et \xE9valuations automatis\xE9\
            s des vuln\xE9rabilit\xE9s des actifs de TIC qui soutiennent des fonctions\
            \ critiques ou importantes."
    - urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:article-10:2
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:article-10
      description: For the purposes of point (c), financial entities shall request
        that ICT third-party service providers investigate the relevant vulnerabilities,
        determine the root causes, and implement appropriate mitigating action.
      translations:
        fr:
          description: "Aux fins du point c), les entit\xE9s financi\xE8res demandent\
            \ aux prestataires tiers de services TIC d\u2019enqu\xEAter sur les vuln\xE9\
            rabilit\xE9s concern\xE9es, d\u2019en d\xE9terminer les causes profondes\
            \ et de mettre en \u0153uvre des mesures d\u2019att\xE9nuation appropri\xE9\
            es."
    - urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:article-10:3
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:article-10
      description: For the purposes of point (d), financial entities shall, where
        appropriate in collaboration with the ICT third-party service provider, monitor
        the version and possible updates of the third-party libraries. In case of
        ready to use (off-the-shelf) ICT assets or components of ICT assets acquired
        and used in the operation of ICT services not supporting critical or important
        functions, financial entities shall track the usage to the extent possible
        of third-party libraries, including open-source libraries.
      translations:
        fr:
          description: "Aux fins du point d), les entit\xE9s financi\xE8res surveillent,\
            \ le cas \xE9ch\xE9ant en collaboration avec le prestataire tiers de services\
            \ TIC, les versions et mises \xE0 jour \xE9ventuelles des biblioth\xE8\
            ques tierces. Dans le cas d\u2019actifs de TIC pr\xEAts \xE0 l\u2019emploi\
            \ ou de composants d\u2019actifs de TIC acquis et utilis\xE9s dans le\
            \ cadre de l\u2019exploitation de services TIC qui ne soutiennent pas\
            \ des fonctions critiques ou importantes, les entit\xE9s financi\xE8res\
            \ tracent, dans la mesure du possible, l\u2019utilisation de biblioth\xE8\
            ques tierces, y compris des biblioth\xE8ques \xE0 code source ouvert."
    - urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:article-10:4
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:article-10
      description: For the purposes of point (f), financial entities shall consider
        the criticality of the vulnerability, the classification established in accordance
        with Article 8(1) of Regulation (EU) 2022/2554, and the risk profile of the
        ICT assets affected by the identified vulnerabilities
      translations:
        fr:
          description: "Aux fins du point f), les entit\xE9s financi\xE8res tiennent\
            \ compte de la criticit\xE9 des vuln\xE9rabilit\xE9s, de la classification\
            \ \xE9tablie conform\xE9ment \xE0 l\u2019article 8, paragraphe 1, du r\xE8\
            glement (UE) 2022/2554 et du profil de risque des actifs de TIC concern\xE9\
            s par les vuln\xE9rabilit\xE9s d\xE9cel\xE9es."
    - urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:10.3
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:article-10
      ref_id: '10.3'
      description: As part of the ICT security policies, procedures, protocols, and
        tools referred to in Article 9(2) of Regulation (EU) 2022/2554, financial
        entities shall develop, document and implement patch management procedures.
      translations:
        fr:
          description: "Dans le cadre des politiques, proc\xE9dures, protocoles et\
            \ outils de s\xE9curit\xE9 des TIC vis\xE9s \xE0 l\u2019article 9, paragraphe\
            \ 2, du r\xE8glement (UE) 2022/2554, les entit\xE9s financi\xE8res \xE9\
            laborent, documentent et mettent en \u0153uvre des proc\xE9dures de gestion\
            \ des correctifs."
    - urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:10.4
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:article-10
      ref_id: '10.4'
      description: 'The patch management procedures referred to in paragraph 3 shall:'
      translations:
        fr:
          description: "Les proc\xE9dures de gestion des correctifs vis\xE9es au paragraphe\
            \ 3:"
    - urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:10.4.a
      assessable: true
      depth: 6
      parent_urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:10.4
      ref_id: 10.4.a
      description: to the extent possible identify and evaluate available software
        and hardware patches and updates using automated tools;
      translations:
        fr:
          description: "dans la mesure du possible, identifient et \xE9valuent les\
            \ correctifs et mises \xE0 jour logiciels et mat\xE9riels disponibles\
            \ \xE0 l\u2019aide d\u2019outils automatis\xE9s;"
    - urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:10.4.b
      assessable: true
      depth: 6
      parent_urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:10.4
      ref_id: 10.4.b
      description: identify emergency procedures for the patching and updating of
        ICT assets;
      translations:
        fr:
          description: "d\xE9finissent des proc\xE9dures d\u2019urgence pour l\u2019\
            application des correctifs et des mises \xE0 jour des actifs de TIC;"
    - urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:10.4.c
      assessable: true
      depth: 6
      parent_urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:10.4
      ref_id: 10.4.c
      description: test and deploy the software and hardware patches and the updates
        referred to in Article 8(2), points (b)(v), (vi) and (vii);
      translations:
        fr:
          description: "testent et d\xE9ploient les correctifs logiciels et mat\xE9\
            riels et les mises \xE0 jour vis\xE9es \xE0 l\u2019article 8, paragraphe\
            \ 2, point b) v), vi) et vii);"
    - urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:10.4.d
      assessable: true
      depth: 6
      parent_urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:10.4
      ref_id: 10.4.d
      description: set deadlines for the installation of software and hardware patches
        and updates and escalation procedures in case those deadlines cannot be met.
      translations:
        fr:
          description: "fixent des d\xE9lais pour l\u2019installation des correctifs\
            \ et mises \xE0 jour logiciels et mat\xE9riels, ainsi que des proc\xE9\
            dures de remont\xE9e d\u2019informations lorsque ces d\xE9lais ne peuvent\
            \ pas \xEAtre respect\xE9s."
    - urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:article-11
      assessable: false
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:section-5
      ref_id: Article 11
      description: Data and system security
      translations:
        fr:
          description: "S\xE9curit\xE9 des donn\xE9es et des syst\xE8mes"
    - urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:11.1
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:article-11
      ref_id: '11.1'
      description: As part of the ICT security policies, procedures, protocols, and
        tools referred to in Article 9(2) of Regulation (EU) 2022/2554, financial
        entities shall develop, document, and implement a data and system security
        procedure.
      translations:
        fr:
          description: "Dans le cadre des politiques, proc\xE9dures, protocoles et\
            \ outils de s\xE9curit\xE9 des TIC vis\xE9s \xE0 l\u2019article 9, paragraphe\
            \ 2, du r\xE8glement (UE) 2022/2554, les entit\xE9s financi\xE8res \xE9\
            laborent, documentent et mettent en \u0153uvre une proc\xE9dure de s\xE9\
            curit\xE9 des donn\xE9es et des syst\xE8mes."
    - urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:11.2
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:article-11
      ref_id: '11.2'
      description: 'The data and system security procedure referred to in paragraph
        1 shall contain all of the following elements related to data and ICT system
        security, in accordance with the classification established in accordance
        with Article 8(1) of Regulation (EU) 2022/2554:'
      translations:
        fr:
          description: "La proc\xE9dure de s\xE9curit\xE9 des donn\xE9es et des syst\xE8\
            mes vis\xE9e au paragraphe 1 contient tous les \xE9l\xE9ments suivants\
            \ relatifs \xE0 la s\xE9curit\xE9 des donn\xE9es et des syst\xE8mes de\
            \ TIC, conform\xE9ment \xE0 la classification \xE9tablie en application\
            \ de l\u2019article 8, paragraphe 1, du r\xE8glement (UE) 2022/2554:"
    - urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:11.2.a
      assessable: true
      depth: 6
      parent_urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:11.2
      ref_id: 11.2.a
      description: the access restrictions referred to in Article 21 of this Regulation,
        supporting the protection requirements for each level of classification;
      translations:
        fr:
          description: "les restrictions d\u2019acc\xE8s, vis\xE9es \xE0 l\u2019article\
            \ 21 du pr\xE9sent r\xE8glement, appuyant les exigences de protection\
            \ pr\xE9vues pour chaque niveau de classification;"
    - urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:11.2.b
      assessable: true
      depth: 6
      parent_urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:11.2
      ref_id: 11.2.b
      description: the identification of a secure configuration baseline for ICT assets
        that minimise exposure of those ICT assets to cyber threats and measures to
        verify regularly that those baselines are effectively deployed;
      translations:
        fr:
          description: "l\u2019identification d\u2019une configuration s\xE9curis\xE9\
            e de r\xE9f\xE9rence pour les actifs de TIC qui r\xE9duise \xE0 un minimum\
            \ l\u2019exposition de ces actifs aux cybermenaces, et des mesures visant\
            \ \xE0 v\xE9rifier r\xE9guli\xE8rement que ces r\xE9f\xE9rences sont effectivement\
            \ d\xE9ploy\xE9es;"
    - urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:11.2.c
      assessable: true
      depth: 6
      parent_urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:11.2
      ref_id: 11.2.c
      description: the identification of security measures to ensure that only authorised
        software is installed in ICT systems and endpoint devices;
      translations:
        fr:
          description: "la d\xE9finition de mesures de s\xE9curit\xE9 visant \xE0\
            \ garantir que seuls des logiciels autoris\xE9s sont install\xE9s dans\
            \ les syst\xE8mes de TIC et les p\xE9riph\xE9riques de point de terminaison;"
    - urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:11.2.d
      assessable: true
      depth: 6
      parent_urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:11.2
      ref_id: 11.2.d
      description: the identification of security measures against malicious codes;
      translations:
        fr:
          description: "la d\xE9finition de mesures de s\xE9curit\xE9 contre les codes\
            \ malveillants;"
    - urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:11.2.e
      assessable: true
      depth: 6
      parent_urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:11.2
      ref_id: 11.2.e
      description: the identification of security measures to ensure that only authorised
        data storage media, systems, and endpoint devices are used to transfer and
        store data of the financial entity;
      translations:
        fr:
          description: "la d\xE9finition de mesures de s\xE9curit\xE9 visant \xE0\
            \ garantir que seuls des supports de stockage de donn\xE9es, des syst\xE8\
            mes et des p\xE9riph\xE9riques de point de terminaison autoris\xE9s sont\
            \ utilis\xE9s pour transf\xE9rer et stocker les donn\xE9es de l\u2019\
            entit\xE9 financi\xE8re;"
    - urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:11.2.f
      assessable: true
      depth: 6
      parent_urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:11.2
      ref_id: 11.2.f
      description: 'the following requirements to secure the use of portable endpoint
        devices and private non-portable endpoint devices:'
      translations:
        fr:
          description: "les exigences suivantes, pour s\xE9curiser l\u2019utilisation\
            \ de p\xE9riph\xE9riques de point de terminaison portables et de p\xE9\
            riph\xE9riques de point de terminaison non portables priv\xE9s:"
    - urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:11.2.f.i
      assessable: true
      depth: 7
      parent_urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:11.2.f
      ref_id: 11.2.f.i
      description: "the requirement to use a management solution to remotely manage\
        \ the endpoint devices and remotely wipe the financial entity\u2019s data;"
      translations:
        fr:
          description: "l\u2019obligation d\u2019utiliser une solution de gestion\
            \ qui permet de g\xE9rer \xE0 distance les p\xE9riph\xE9riques de point\
            \ de terminaison et d\u2019effacer \xE0 distance les donn\xE9es de l\u2019\
            entit\xE9 financi\xE8re;"
    - urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:11.2.f.ii
      assessable: true
      depth: 7
      parent_urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:11.2.f
      ref_id: 11.2.f.ii
      description: the requirement to use security mechanisms that cannot be modified,
        removed or bypassed by staff members or ICT third-party service providers
        in an unauthorised manner;
      translations:
        fr:
          description: "l\u2019obligation d\u2019utiliser des m\xE9canismes de s\xE9\
            curit\xE9 qui ne peuvent pas \xEAtre modifi\xE9s, supprim\xE9s ou contourn\xE9\
            s sans autorisation par des membres du personnel ou par des prestataires\
            \ tiers de services TIC;"
    - urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:11.2.f.iii
      assessable: true
      depth: 7
      parent_urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:11.2.f
      ref_id: 11.2.f.iii
      description: "the requirement to use removable data storage devices only where\
        \ the residual ICT risk remains within the financial entity\u2019s risk tolerance\
        \ level referred to in Article 3(1), point (a);"
      translations:
        fr:
          description: "l\u2019obligation de n\u2019utiliser des dispositifs de stockage\
            \ de donn\xE9es amovibles que lorsque le risque r\xE9siduel li\xE9 aux\
            \ TIC reste dans les limites du niveau de tol\xE9rance au risque de l\u2019\
            entit\xE9 financi\xE8re vis\xE9 \xE0 l\u2019article 3, premier alin\xE9\
            a, point a);"
    - urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:11.2.g
      assessable: true
      depth: 6
      parent_urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:11.2
      ref_id: 11.2.g
      description: the process to securely delete data, present on premises of the
        financial entity or stored externally, that the financial entity no longer
        needs to collect or to store;
      translations:
        fr:
          description: "le processus d\u2019effacement s\xE9curis\xE9 des donn\xE9\
            es, pr\xE9sentes dans les locaux de l\u2019entit\xE9 financi\xE8re ou\
            \ stock\xE9es \xE0 l\u2019ext\xE9rieur, que l\u2019entit\xE9 financi\xE8\
            re n\u2019a plus besoin de collecter ou de stocker;"
    - urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:11.2.h
      assessable: true
      depth: 6
      parent_urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:11.2
      ref_id: 11.2.h
      description: the process to securely dispose or decommission of data storage
        devices present on premises of the financial entity or stored externally containing
        confidential information;
      translations:
        fr:
          description: "le processus d\u2019\xE9limination ou de d\xE9classement en\
            \ toute s\xE9curit\xE9 des dispositifs de stockage de donn\xE9es, pr\xE9\
            sents dans les locaux de l\u2019entit\xE9 financi\xE8re ou stock\xE9s\
            \ \xE0 l\u2019ext\xE9rieur, qui contiennent des informations confidentielles;"
    - urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:11.2.i
      assessable: true
      depth: 6
      parent_urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:11.2
      ref_id: 11.2.i
      description: the identification and implementation of security measures to prevent
        data loss and leakage for systems and endpoint devices;
      translations:
        fr:
          description: "la d\xE9finition et la mise en \u0153uvre, pour les syst\xE8\
            mes et les p\xE9riph\xE9riques de point de terminaison, de mesures de\
            \ s\xE9curit\xE9 visant \xE0 pr\xE9venir la perte et la fuite de donn\xE9\
            es;"
    - urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:11.2.j
      assessable: true
      depth: 6
      parent_urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:11.2
      ref_id: 11.2.j
      description: the implementation of security measures to ensure that teleworking
        and the use of private endpoint devices does not adversely impact the ICT
        security of the financial entity;
      translations:
        fr:
          description: "la mise en \u0153uvre de mesures de s\xE9curit\xE9 visant\
            \ \xE0 garantir que le t\xE9l\xE9travail et l\u2019utilisation de p\xE9\
            riph\xE9riques de point de terminaison priv\xE9s n\u2019aient pas d\u2019\
            incidence n\xE9gative sur la s\xE9curit\xE9 des TIC de l\u2019entit\xE9\
            \ financi\xE8re;"
    - urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:11.2.k
      assessable: true
      depth: 6
      parent_urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:11.2
      ref_id: 11.2.k
      description: for ICT assets or services operated by an ICT third-party service
        provider, the identification and implementation of requirements to maintain
        digital operational resilience, in accordance with the results of the data
        classification and ICT risk assessment.
      translations:
        fr:
          description: "pour les actifs de TIC ou les services TIC exploit\xE9s par\
            \ un prestataire tiers de services TIC, la d\xE9finition et la mise en\
            \ \u0153uvre d\u2019exigences visant \xE0 maintenir la r\xE9silience op\xE9\
            rationnelle num\xE9rique, conform\xE9ment aux r\xE9sultats de la classification\
            \ des donn\xE9es et de l\u2019\xE9valuation du risque li\xE9 aux TIC."
    - urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:article-11:1
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:article-11
      description: For the purposes of point (b), the secure configuration baseline
        referred to in that point shall take into account leading practices and appropriate
        techniques laid down in the standards defined in Article 2, point (1), of
        Regulation (EU) No 1025/2012.
      translations:
        fr:
          description: "La configuration s\xE9curis\xE9e de r\xE9f\xE9rence vis\xE9\
            e au point b) tient compte, aux fins dudit point, des pratiques de pointe\
            \ et des techniques appropri\xE9es d\xE9finies dans les normes vis\xE9\
            es \xE0 l\u2019article 2, point 1), du r\xE8glement (UE) no 1025/2012."
    - urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:article-11:2
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:article-11
      description: 'For the purposes of point (k), financial entities shall consider
        the following:'
      translations:
        fr:
          description: "Aux fins du point k), les entit\xE9s financi\xE8res prennent\
            \ en consid\xE9ration les \xE9l\xE9ments suivants:"
    - urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:article-11:2:1
      assessable: true
      depth: 6
      parent_urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:article-11:2
      description: (a)the implementation of vendor recommended settings on the elements
        operated by the financial entity;
      translations:
        fr:
          description: "l\u2019application de param\xE8tres recommand\xE9s par le\
            \ vendeur aux \xE9l\xE9ments exploit\xE9s par l\u2019entit\xE9 financi\xE8\
            re;"
    - urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:article-11:2:2
      assessable: true
      depth: 6
      parent_urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:article-11:2
      description: "(b)a clear allocation of information security roles and responsibilities\
        \ between the financial entity and the ICT third-party service provider, in\
        \ accordance with the principle of full responsibility of the financial entity\
        \ over its ICT third-party service provider referred to in Article 28(1),\
        \ point (a), of Regulation (EU) 2022/2554, and for financial entities referred\
        \ to in Article 28(2) of that Regulation, and in accordance with the financial\
        \ entity\u2019s policy on the use of ICT services supporting critical or important\
        \ functions;"
      translations:
        fr:
          description: "une attribution claire des r\xF4les et des responsabilit\xE9\
            s en mati\xE8re de s\xE9curit\xE9 de l\u2019information entre l\u2019\
            entit\xE9 financi\xE8re et le prestataire tiers de services TIC, conform\xE9\
            ment au principe, d\xE9fini \xE0 l\u2019article 28, paragraphe 1, point\
            \ a), du r\xE8glement (UE) 2022/2554, selon lequel l\u2019entit\xE9 financi\xE8\
            re est pleinement responsable de son prestataire tiers de services TIC,\
            \ et conform\xE9ment \xE0 la politique de l\u2019entit\xE9 financi\xE8\
            re relative \xE0 l\u2019utilisation de services TIC qui soutiennent des\
            \ fonctions critiques ou importantes, pour les entit\xE9s financi\xE8\
            res vis\xE9es \xE0 l\u2019article 28, paragraphe 2, dudit r\xE8glement;"
    - urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:article-11:2:3
      assessable: true
      depth: 6
      parent_urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:article-11:2
      description: (c)the need to ensure and maintain adequate competences within
        the financial entity in the management and security of the service used;
      translations:
        fr:
          description: "la n\xE9cessit\xE9 de garantir et de maintenir des comp\xE9\
            tences ad\xE9quates au sein de l\u2019entit\xE9 financi\xE8re en mati\xE8\
            re de gestion et de s\xE9curit\xE9 du service utilis\xE9;"
    - urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:article-11:2:4
      assessable: true
      depth: 6
      parent_urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:article-11:2
      description: (d)technical and organisational measures to minimise the risks
        related to the infrastructure used by the ICT third-party service provider
        for its ICT services, considering leading practices, and standards as defined
        in Article 2, point (1), of Regulation (EU) No 1025/2012.
      translations:
        fr:
          description: "des mesures techniques et organisationnelles visant \xE0 r\xE9\
            duire \xE0 un minimum les risques li\xE9s \xE0 l\u2019infrastructure utilis\xE9\
            e par le prestataire tiers de services TIC pour ses services TIC, compte\
            \ tenu des pratiques de pointe et des normes telles que d\xE9finies \xE0\
            \ l\u2019article 2, point 1), du r\xE8glement (UE) no 1025/2012."
    - urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:article-12
      assessable: false
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:section-5
      ref_id: Article 12
      description: Logging
      translations:
        fr:
          description: Journalisation
    - urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:12.1
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:article-12
      ref_id: '12.1'
      description: Financial entities shall, as part of the safeguards against intrusions
        and data misuse, develop, document, and implement logging procedures, protocols
        and tools.
      translations:
        fr:
          description: "Dans le cadre des garanties contre les intrusions et l\u2019\
            utilisation abusive de donn\xE9es, les entit\xE9s financi\xE8res \xE9\
            laborent, documentent et mettent en \u0153uvre des proc\xE9dures, protocoles\
            \ et outils de journalisation."
    - urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:12.2
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:article-12
      ref_id: '12.2'
      description: 'The logging procedures, protocols, and tools referred to in paragraph
        1 shall contain all of the following:'
      translations:
        fr:
          description: "Les proc\xE9dures, protocoles et outils de journalisation\
            \ vis\xE9s au paragraphe 1 contiennent l\u2019ensemble des \xE9l\xE9ments\
            \ suivants:"
    - urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:12.2.a
      assessable: true
      depth: 6
      parent_urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:12.2
      ref_id: 12.2.a
      description: the identification of the events to be logged, the retention period
        of the logs, and the measures to secure and handle the log data, considering
        the purpose for which the logs are created;
      translations:
        fr:
          description: "l\u2019identification des \xE9v\xE9nements \xE0 enregistrer\
            \ dans le journal, la dur\xE9e de conservation des journaux et les mesures\
            \ visant \xE0 s\xE9curiser et \xE0 g\xE9rer les donn\xE9es des journaux,\
            \ en tenant compte de la finalit\xE9 pour laquelle les journaux sont cr\xE9\
            \xE9s;"
    - urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:12.2.b
      assessable: true
      depth: 6
      parent_urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:12.2
      ref_id: 12.2.b
      description: the alignment of the level of detail of the logs with their purpose
        and usage to enable the effective detection of anomalous activities as referred
        to in Article 24;
      translations:
        fr:
          description: "l\u2019alignement du niveau de d\xE9tail des journaux sur\
            \ leur finalit\xE9 et leur utilisation, afin de permettre la d\xE9tection\
            \ effective des activit\xE9s anormales vis\xE9es \xE0 l\u2019article 24;"
    - urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:12.2.c
      assessable: true
      depth: 6
      parent_urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:12.2
      ref_id: 12.2.c
      description: 'the requirement to log events related to all of the following:'
      translations:
        fr:
          description: "l\u2019obligation de consigner dans les journaux les \xE9\
            v\xE9nements relatifs \xE0 l\u2019ensemble des \xE9l\xE9ments suivants:"
    - urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:12.2.c.i
      assessable: true
      depth: 7
      parent_urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:12.2.c
      ref_id: 12.2.c.i
      description: logical and physical access control, as referred to in Article
        21, and identity management;
      translations:
        fr:
          description: "le contr\xF4le de l\u2019acc\xE8s logique et physique, tel\
            \ que vis\xE9 \xE0 l\u2019article 21, et la gestion de l\u2019identit\xE9\
            ;"
    - urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:12.2.c.ii
      assessable: true
      depth: 7
      parent_urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:12.2.c
      ref_id: 12.2.c.ii
      description: capacity management;
      translations:
        fr:
          description: "la gestion des capacit\xE9s;"
    - urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:12.2.c.iii
      assessable: true
      depth: 7
      parent_urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:12.2.c
      ref_id: 12.2.c.iii
      description: change management;
      translations:
        fr:
          description: la gestion des modifications;
    - urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:12.2.c.iv
      assessable: true
      depth: 7
      parent_urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:12.2.c
      ref_id: 12.2.c.iv
      description: ICT operations, including ICT system activities;
      translations:
        fr:
          description: "les op\xE9rations de TIC, y compris les activit\xE9s li\xE9\
            es aux syst\xE8mes de TIC;"
    - urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:12.2.c.v
      assessable: true
      depth: 7
      parent_urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:12.2.c
      ref_id: 12.2.c.v
      description: network traffic activities, including ICT network performance;
      translations:
        fr:
          description: "le trafic r\xE9seau, y compris les performances des r\xE9\
            seaux de TIC;"
    - urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:12.2.d
      assessable: true
      depth: 6
      parent_urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:12.2
      ref_id: 12.2.d
      description: measures to protect logging systems and log information against
        tampering, deletion, and unauthorised access at rest, in transit, and, where
        relevant, in use;
      translations:
        fr:
          description: "des mesures visant \xE0 prot\xE9ger les syst\xE8mes de journalisation\
            \ et les informations des journaux contre les manipulations, la suppression\
            \ et l\u2019acc\xE8s non autoris\xE9, au repos, en transit et, le cas\
            \ \xE9ch\xE9ant, en cours d\u2019utilisation;"
    - urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:12.2.e
      assessable: true
      depth: 6
      parent_urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:12.2
      ref_id: 12.2.e
      description: measures to detect a failure of logging systems;
      translations:
        fr:
          description: "des mesures visant \xE0 d\xE9tecter les d\xE9faillances des\
            \ syst\xE8mes de journalisation;"
    - urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:12.2.f
      assessable: true
      depth: 6
      parent_urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:12.2
      ref_id: 12.2.f
      description: "without prejudice to any applicable regulatory requirements under\
        \ Union or national law, the synchronisation of the clocks of each of the\
        \ financial entity\u2019s ICT systems upon a documented reliable reference\
        \ time source."
      translations:
        fr:
          description: "sans pr\xE9judice de toute exigence r\xE9glementaire applicable\
            \ en vertu du droit de l\u2019Union ou du droit national, la synchronisation\
            \ des horloges de chacun des syst\xE8mes de TIC de l\u2019entit\xE9 financi\xE8\
            re avec une horloge de r\xE9f\xE9rence fiable et document\xE9e."
    - urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:article-12:1
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:article-12
      description: For the purposes of point (a), financial entities shall establish
        the retention period, taking into account the business and information security
        objectives, the reason for recording the event in the logs, and the results
        of the ICT risk assessment.
      translations:
        fr:
          description: "Aux fins du point a), les entit\xE9s financi\xE8res d\xE9\
            finissent la dur\xE9e de conservation, en prenant en consid\xE9ration\
            \ les objectifs en mati\xE8re de s\xE9curit\xE9 des activit\xE9s et de\
            \ l\u2019information, la raison de l\u2019enregistrement de l\u2019\xE9\
            v\xE9nement dans les journaux et les r\xE9sultats de l\u2019\xE9valuation\
            \ du risque li\xE9 aux TIC."
    - urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:section-6
      assessable: false
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:title-ii:1
      ref_id: SECTION 6
      description: NETWORK SECURITY
      translations:
        fr:
          description: "S\xE9curit\xE9 des r\xE9seaux"
    - urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:article-13
      assessable: false
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:section-6
      ref_id: Article 13
      description: Network security management
      translations:
        fr:
          description: "Gestion de la s\xE9curit\xE9 des r\xE9seaux"
    - urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:13.1
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:article-13
      ref_id: '13.1'
      description: 'Financial entities shall, as part of the safeguards ensuring the
        security of network against intrusions and data misuse, develop, document,
        and implement policies, procedures, protocols, and tools on network security
        management, including all of the following:'
      translations:
        fr:
          description: "Dans le cadre des garanties de s\xE9curit\xE9 des r\xE9seaux\
            \ contre les intrusions et l\u2019utilisation abusive de donn\xE9es, les\
            \ entit\xE9s financi\xE8res \xE9laborent, documentent et mettent en \u0153\
            uvre des politiques, des proc\xE9dures, des protocoles et des outils de\
            \ gestion de la s\xE9curit\xE9 des r\xE9seaux comprenant l\u2019ensemble\
            \ des \xE9l\xE9ments suivants:"
    - urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:13.1.a
      assessable: true
      depth: 6
      parent_urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:13.1
      ref_id: 13.1.a
      description: 'the segregation and segmentation of ICT systems and networks taking
        into account:'
      translations:
        fr:
          description: "la s\xE9paration et la segmentation des syst\xE8mes et r\xE9\
            seaux de TIC, compte tenu:"
    - urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:13.1.a.i
      assessable: true
      depth: 7
      parent_urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:13.1.a
      ref_id: 13.1.a.i
      description: the criticality or importance of the function those ICT systems
        and networks support;
      translations:
        fr:
          description: "de la criticit\xE9 ou de l\u2019importance de la fonction\
            \ que soutiennent ces syst\xE8mes et r\xE9seaux de TIC;"
    - urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:13.1.a.ii
      assessable: true
      depth: 7
      parent_urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:13.1.a
      ref_id: 13.1.a.ii
      description: the classification established in accordance with Article 8(1)
        of Regulation (EU) 2022/2554;
      translations:
        fr:
          description: "de la classification \xE9tablie conform\xE9ment \xE0 l\u2019\
            article 8, paragraphe 1, du r\xE8glement (UE) 2022/2554;"
    - urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:13.1.a.iii
      assessable: true
      depth: 7
      parent_urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:13.1.a
      ref_id: 13.1.a.iii
      description: the overall risk profile of ICT assets using those ICT systems
        and networks;
      translations:
        fr:
          description: "du profil de risque global des actifs de TIC qui utilisent\
            \ ces syst\xE8mes et r\xE9seaux de TIC;"
    - urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:13.1.b
      assessable: true
      depth: 6
      parent_urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:13.1
      ref_id: 13.1.b
      description: "the documentation of all of the financial entity\u2019s network\
        \ connections and data flows;"
      translations:
        fr:
          description: "la documentation de l\u2019ensemble des connexions r\xE9seau\
            \ et des flux de donn\xE9es de l\u2019entit\xE9 financi\xE8re;"
    - urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:13.1.c
      assessable: true
      depth: 6
      parent_urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:13.1
      ref_id: 13.1.c
      description: the use of a separate and dedicated network for the administration
        of ICT assets;
      translations:
        fr:
          description: "l\u2019utilisation d\u2019un r\xE9seau distinct et sp\xE9\
            cifique pour l\u2019administration des actifs de TIC;"
    - urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:13.1.d
      assessable: true
      depth: 6
      parent_urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:13.1
      ref_id: 13.1.d
      description: the identification and implementation of network access controls
        to prevent and detect connections to the financial entity's network by any
        unauthorised device or system, or any endpoint not meeting the financial entity's
        security requirements;
      translations:
        fr:
          description: "la d\xE9finition et la mise en \u0153uvre de contr\xF4les\
            \ d\u2019acc\xE8s au r\xE9seau afin de pr\xE9venir et de d\xE9tecter les\
            \ connexions au r\xE9seau de l\u2019entit\xE9 financi\xE8re \xE0 partir\
            \ de tout appareil ou syst\xE8me non autoris\xE9, ou de tout point de\
            \ terminaison ne r\xE9pondant pas aux exigences de l\u2019entit\xE9 financi\xE8\
            re en mati\xE8re de s\xE9curit\xE9;"
    - urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:13.1.e
      assessable: true
      depth: 6
      parent_urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:13.1
      ref_id: 13.1.e
      description: the encryption of network connections passing over corporate networks,
        public networks, domestic networks, third-party networks, and wireless networks,
        for communication protocols used, taking into account the results of the approved
        data classification, the results of the ICT risk assessment and the encryption
        of network connections referred to in Article 6(2);
      translations:
        fr:
          description: "le chiffrement des connexions au r\xE9seau transitant par\
            \ des r\xE9seaux d\u2019entreprise, des r\xE9seaux publics, des r\xE9\
            seaux nationaux, des r\xE9seaux tiers et des r\xE9seaux sans fil, pour\
            \ les protocoles de communication utilis\xE9s, en tenant compte des r\xE9\
            sultats de la classification de donn\xE9es approuv\xE9e, des r\xE9sultats\
            \ de l\u2019\xE9valuation du risque li\xE9 aux TIC et du chiffrement des\
            \ connexions au r\xE9seau pr\xE9vu par l\u2019article 6, paragraphe 2;"
    - urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:13.1.f
      assessable: true
      depth: 6
      parent_urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:13.1
      ref_id: 13.1.f
      description: the design of networks in line with the ICT security requirements
        established by the financial entity, taking into account leading practices
        to ensure the confidentiality, integrity, and availability of the network;
      translations:
        fr:
          description: "une conception du r\xE9seau conforme aux exigences en mati\xE8\
            re de s\xE9curit\xE9 des TIC d\xE9finies par l\u2019entit\xE9 financi\xE8\
            re, tenant compte des pratiques de pointe afin de garantir la confidentialit\xE9\
            , l\u2019int\xE9grit\xE9 et la disponibilit\xE9 du r\xE9seau;"
    - urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:13.1.g
      assessable: true
      depth: 6
      parent_urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:13.1
      ref_id: 13.1.g
      description: the securing of network traffic between the internal networks and
        the internet and other external connections;
      translations:
        fr:
          description: "la s\xE9curisation du trafic entre les r\xE9seaux internes\
            \ et l\u2019internet et d\u2019autres connexions externes;"
    - urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:13.1.h
      assessable: true
      depth: 6
      parent_urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:13.1
      ref_id: 13.1.h
      description: the identification of the roles and responsibilities and steps
        for the specification, implementation, approval, change, and review of firewall
        rules and connections filters;
      translations:
        fr:
          description: "la d\xE9finition des r\xF4les et responsabilit\xE9s et des\
            \ \xE9tapes de la sp\xE9cification, de la mise en \u0153uvre, de l\u2019\
            approbation, de la modification et du r\xE9examen des r\xE8gles de pare-feu\
            \ et des filtres de connexion;"
    - urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:13.1.i
      assessable: true
      depth: 6
      parent_urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:13.1
      ref_id: 13.1.i
      description: the performance of reviews of the network architecture and of the
        network security design once a year, and periodically for microenterprises,
        to identify potential vulnerabilities;
      translations:
        fr:
          description: "la r\xE9alisation d\u2019examens de l\u2019architecture du\
            \ r\xE9seau et de la conception de la s\xE9curit\xE9 du r\xE9seau une\
            \ fois par an, et p\xE9riodiquement pour les microentreprises, afin de\
            \ d\xE9tecter les vuln\xE9rabilit\xE9s potentielles;"
    - urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:13.1.j
      assessable: true
      depth: 6
      parent_urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:13.1
      ref_id: 13.1.j
      description: the measures to temporarily isolate, where necessary, subnetworks,
        and network components and devices;
      translations:
        fr:
          description: "des mesures visant \xE0 isoler temporairement, si n\xE9cessaire,\
            \ les sous-r\xE9seaux et les composants et dispositifs de r\xE9seau;"
    - urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:13.1.k
      assessable: true
      depth: 6
      parent_urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:13.1
      ref_id: 13.1.k
      description: the implementation of a secure configuration baseline of all network
        components, and the hardening of the network and of network devices in line
        with any vendor instructions, where applicable standards, as defined in Article
        2, point (1), of Regulation (EU) No 1025/2012, and leading practices;
      translations:
        fr:
          description: "la mise en \u0153uvre d\u2019une configuration s\xE9curis\xE9\
            e de r\xE9f\xE9rence incluant tous les composants du r\xE9seau, et le\
            \ renforcement du r\xE9seau et des dispositifs de r\xE9seau conform\xE9\
            ment aux \xE9ventuelles instructions du vendeur, aux normes telles que\
            \ d\xE9finies \xE0 l\u2019article 2, point 1), du r\xE8glement (UE) no\
            \ 1025/2012, le cas \xE9ch\xE9ant, et aux pratiques de pointe;"
    - urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:13.1.l
      assessable: true
      depth: 6
      parent_urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:13.1
      ref_id: 13.1.l
      description: the procedures to limit, lock, and terminate system and remote
        sessions after a specified period of inactivity;
      translations:
        fr:
          description: "les proc\xE9dures de limitation, de verrouillage et d\u2019\
            arr\xEAt du syst\xE8me et des sessions \xE0 distance apr\xE8s une p\xE9\
            riode d\xE9termin\xE9e d\u2019inactivit\xE9;"
    - urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:13.1.m
      assessable: true
      depth: 6
      parent_urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:13.1
      ref_id: 13.1.m
      description: 'for network services agreements:'
      translations:
        fr:
          description: "pour les accords de services de r\xE9seau:"
    - urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:13.1.m.i
      assessable: true
      depth: 7
      parent_urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:13.1.m
      ref_id: 13.1.m.i
      description: the identification and specification of ICT and information security
        measures, service levels, and management requirements of all network services;
      translations:
        fr:
          description: "l\u2019indication et la sp\xE9cification des mesures de s\xE9\
            curit\xE9 des TIC et de l\u2019information, des niveaux de service et\
            \ des exigences en mati\xE8re de gestion de tous les services de r\xE9\
            seau;"
    - urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:13.1.m.ii
      assessable: true
      depth: 7
      parent_urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:13.1.m
      ref_id: 13.1.m.ii
      description: whether those services are provided by an ICT intra-group service
        provider or by ICT third-party service providers.
      translations:
        fr:
          description: "une indication pr\xE9cisant si ces services sont fournis par\
            \ un prestataire intra-groupe de services TIC ou par des prestataires\
            \ tiers de services TIC."
    - urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:article-13:1
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:article-13
      description: For the purposes of point (h), financial entities shall perform
        the review of firewall rules and connections filters on a regular basis in
        accordance with the classification established in accordance with Article
        8(1) of Regulation (EU) 2022/2554 and the overall risk profile of ICT systems
        involved. For ICT systems that support critical or important functions, financial
        entities shall verify the adequacy of the existing firewall rules and connection
        filters at least every 6 months.
      translations:
        fr:
          description: "Aux fins du point h), les entit\xE9s financi\xE8res proc\xE8\
            dent \xE0 un r\xE9examen r\xE9gulier des r\xE8gles de pare-feu et des\
            \ filtres de connexion, conform\xE9ment \xE0 la classification \xE9tablie\
            \ en application de l\u2019article 8, paragraphe 1, du r\xE8glement (UE)\
            \ 2022/2554 et au profil de risque global des syst\xE8mes de TIC concern\xE9\
            s. Pour les syst\xE8mes de TIC qui soutiennent des fonctions critiques\
            \ ou importantes, les entit\xE9s financi\xE8res v\xE9rifient l\u2019ad\xE9\
            quation des r\xE8gles de pare-feu et des filtres de connexion existants\
            \ au moins tous les six mois."
    - urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:article-14
      assessable: false
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:section-6
      ref_id: Article 14
      description: Securing information in transit
      translations:
        fr:
          description: "S\xE9curisation des informations en transit"
    - urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:14.1
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:article-14
      ref_id: '14.1'
      description: 'As part of the safeguards to preserve the availability, authenticity,
        integrity and confidentiality of data, financial entities shall develop, document,
        and implement the policies, procedures, protocols, and tools to protect information
        in transit. Financial entities shall in particular ensure all of the following:'
      translations:
        fr:
          description: "Dans le cadre des garanties visant \xE0 pr\xE9server la disponibilit\xE9\
            , l\u2019authenticit\xE9, l\u2019int\xE9grit\xE9 et la confidentialit\xE9\
            \ des donn\xE9es, les entit\xE9s financi\xE8res \xE9laborent, documentent\
            \ et mettent en \u0153uvre les politiques, proc\xE9dures, protocoles et\
            \ outils de protection des informations en transit. Les entit\xE9s financi\xE8\
            res veillent en particulier \xE0 l\u2019ensemble des \xE9l\xE9ments suivants:"
    - urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:14.1.a
      assessable: true
      depth: 6
      parent_urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:14.1
      ref_id: 14.1.a
      description: the availability, authenticity, integrity and confidentiality of
        data during network transmission, and the establishment of procedures to assess
        compliance with those requirements;
      translations:
        fr:
          description: "la disponibilit\xE9, l\u2019authenticit\xE9, l\u2019int\xE9\
            grit\xE9 et la confidentialit\xE9 des donn\xE9es pendant la transmission\
            \ sur le r\xE9seau, et l\u2019\xE9tablissement de proc\xE9dures permettant\
            \ d\u2019\xE9valuer le respect de ces exigences;"
    - urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:14.1.b
      assessable: true
      depth: 6
      parent_urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:14.1
      ref_id: 14.1.b
      description: the prevention and detection of data leakages and the secure transfer
        of information between the financial entity and external parties;
      translations:
        fr:
          description: "la pr\xE9vention et la d\xE9tection des fuites de donn\xE9\
            es et le transfert s\xE9curis\xE9 d\u2019informations entre l\u2019entit\xE9\
            \ financi\xE8re et des parties externes;"
    - urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:14.1.c
      assessable: true
      depth: 6
      parent_urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:14.1
      ref_id: 14.1.c
      description: "that requirements on confidentiality or non-disclosure arrangements\
        \ reflecting the financial entity\u2019s needs for the protection of information\
        \ for both the staff of the financial entity and of third parties are implemented,\
        \ documented, and regularly reviewed."
      translations:
        fr:
          description: "la mise en \u0153uvre, la documentation et le r\xE9examen\
            \ r\xE9gulier d\u2019exigences relatives \xE0 des accords de confidentialit\xE9\
            \ ou de non-divulgation refl\xE9tant les besoins de l\u2019entit\xE9 financi\xE8\
            re en mati\xE8re de protection des informations tant pour son personnel\
            \ que pour les tiers."
    - urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:14.2
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:article-14
      ref_id: '14.2'
      description: Financial entities shall design the policies, procedures, protocols,
        and tools to protect the information in transit referred to in paragraph 1
        on the basis of the results of the approved data classification and of the
        ICT risk assessment.
      translations:
        fr:
          description: "Les entit\xE9s financi\xE8res con\xE7oivent les politiques,\
            \ proc\xE9dures, protocoles et outils visant \xE0 prot\xE9ger les informations\
            \ en transit vis\xE9es au paragraphe 1 sur la base des r\xE9sultats de\
            \ la classification des donn\xE9es approuv\xE9e et de l\u2019\xE9valuation\
            \ du risque li\xE9 aux TIC."
    - urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:section-7
      assessable: false
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:title-ii:1
      ref_id: SECTION 7
      description: ICT PROJECT AND CHANGE MANAGEMENT
      translations:
        fr:
          description: Gestion des projets de TIC et des changements dans les TIC
    - urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:article-15
      assessable: false
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:section-7
      ref_id: Article 15
      description: ICT project management
      translations:
        fr:
          description: Gestion des projets de TIC
    - urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:15.1
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:article-15
      ref_id: '15.1'
      description: As part of the safeguards to preserve the availability, authenticity,
        integrity, and confidentiality of data, financial entities shall develop,
        document, and implement an ICT project management policy.
      translations:
        fr:
          description: "Dans le cadre des garanties visant \xE0 pr\xE9server la disponibilit\xE9\
            , l\u2019authenticit\xE9, l\u2019int\xE9grit\xE9 et la confidentialit\xE9\
            \ des donn\xE9es, les entit\xE9s financi\xE8res \xE9laborent, documentent\
            \ et mettent en \u0153uvre une politique de gestion des projets de TIC."
    - urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:15.2
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:article-15
      ref_id: '15.2'
      description: "The ICT project management policy referred to in paragraph 1 shall\
        \ specify the elements that ensure the effective management of the ICT projects\
        \ related to the acquisition, maintenance and, where applicable, development\
        \ of the financial entity\u2019s ICT systems"
      translations:
        fr:
          description: "La politique de gestion des projets de TIC vis\xE9e au paragraphe\
            \ 1 pr\xE9cise les \xE9l\xE9ments qui garantissent la gestion efficace\
            \ des projets de TIC li\xE9s \xE0 l\u2019acquisition, \xE0 la maintenance\
            \ et, le cas \xE9ch\xE9ant, au d\xE9veloppement des syst\xE8mes de TIC\
            \ de l\u2019entit\xE9 financi\xE8re."
    - urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:15.3
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:article-15
      ref_id: '15.3'
      description: 'The ICT project management policy referred to in paragraph 1 shall
        contain all of the following:'
      translations:
        fr:
          description: "La politique de gestion des projets de TIC vis\xE9e au paragraphe\
            \ 1 comporte l\u2019ensemble des \xE9l\xE9ments suivants:"
    - urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:15.3.a
      assessable: true
      depth: 6
      parent_urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:15.3
      ref_id: 15.3.a
      description: ICT project objectives;
      translations:
        fr:
          description: les objectifs des projets de TIC;
    - urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:15.3.b
      assessable: true
      depth: 6
      parent_urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:15.3
      ref_id: 15.3.b
      description: ICT project governance, including roles and responsibilities;
      translations:
        fr:
          description: "la gouvernance des projets de TIC, notamment les r\xF4les\
            \ et responsabilit\xE9s;"
    - urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:15.3.c
      assessable: true
      depth: 6
      parent_urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:15.3
      ref_id: 15.3.c
      description: ICT project planning, timeframe, and steps;
      translations:
        fr:
          description: "la planification, le calendrier et les \xE9tapes des projets\
            \ de TIC;"
    - urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:15.3.d
      assessable: true
      depth: 6
      parent_urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:15.3
      ref_id: 15.3.d
      description: ICT project risk assessment;
      translations:
        fr:
          description: "l\u2019\xE9valuation des risques li\xE9s aux projets de TIC;"
    - urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:15.3.e
      assessable: true
      depth: 6
      parent_urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:15.3
      ref_id: 15.3.e
      description: relevant milestones;
      translations:
        fr:
          description: les jalons pertinents;
    - urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:15.3.f
      assessable: true
      depth: 6
      parent_urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:15.3
      ref_id: 15.3.f
      description: change management requirements;
      translations:
        fr:
          description: "les exigences en mati\xE8re de gestion des changements;"
    - urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:15.3.g
      assessable: true
      depth: 6
      parent_urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:15.3
      ref_id: 15.3.g
      description: the testing of all requirements, including security requirements,
        and the respective approval process when deploying an ICT system in the production
        environment.
      translations:
        fr:
          description: "les tests de toutes les exigences, notamment des exigences\
            \ de s\xE9curit\xE9, et le processus d\u2019approbation correspondant\
            \ lors du d\xE9ploiement d\u2019un syst\xE8me de TIC dans l\u2019environnement\
            \ de production."
    - urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:15.4
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:article-15
      ref_id: '15.4'
      description: The ICT project management policy referred to in paragraph 1 shall
        ensure the secure ICT project implementation through the provision of the
        necessary information and expertise from the business area or functions impacted
        by the ICT project.
      translations:
        fr:
          description: "La politique de gestion des projets de TIC vis\xE9e au paragraphe\
            \ 1 garantit la s\xE9curit\xE9 de la mise en \u0153uvre des projets de\
            \ TIC gr\xE2ce \xE0 la fourniture des informations et de l\u2019expertise\
            \ n\xE9cessaires par le domaine d\u2019activit\xE9 ou les fonctions concern\xE9\
            es par les projets de TIC."
    - urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:15.5
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:article-15
      ref_id: '15.5'
      description: 'In accordance with the ICT project risk assessment referred to
        in paragraph 3, point (d), the ICT project management policy referred to in
        paragraph 1 shall provide that the establishment and progress of ICT projects
        impacting critical or important functions of the financial entity and their
        associated risks are reported to the management body as follows:'
      translations:
        fr:
          description: "Conform\xE9ment \xE0 l\u2019\xE9valuation des risques li\xE9\
            s aux projets de TIC vis\xE9e au paragraphe 3, point d), la politique\
            \ de gestion des projets de TIC vis\xE9e au paragraphe 1 pr\xE9voit que\
            \ la mise en place de projets de TIC ayant une incidence sur les fonctions\
            \ critiques ou importantes de l\u2019entit\xE9 financi\xE8re, l\u2019\
            avancement de ces projets et les risques qui y sont associ\xE9s sont notifi\xE9\
            s \xE0 l\u2019organe de direction comme suit:"
    - urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:15.5.a
      assessable: true
      depth: 6
      parent_urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:15.5
      ref_id: 15.5.a
      description: individually or in aggregation, depending on the importance and
        size of the ICT projects;
      translations:
        fr:
          description: "individuellement ou de fa\xE7on group\xE9e, en fonction de\
            \ l\u2019importance et de la taille des projets de TIC;"
    - urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:15.5.b
      assessable: true
      depth: 6
      parent_urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:15.5
      ref_id: 15.5.b
      description: periodically and, where necessary, on an event-driven basis.
      translations:
        fr:
          description: "p\xE9riodiquement et, si n\xE9cessaire, chaque fois qu\u2019\
            un \xE9v\xE8nement l\u2019exige."
    - urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:article-16
      assessable: false
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:section-7
      ref_id: Article 16
      description: ICT systems acquisition, development, and maintenance
      translations:
        fr:
          description: "Acquisition, d\xE9veloppement et maintenance des syst\xE8\
            mes de TIC"
    - urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:16.1
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:article-16
      ref_id: '16.1'
      description: 'As part of the safeguards to preserve the availability, authenticity,
        integrity, and confidentiality of data, financial entities shall develop,
        document and implement a policy governing the acquisition, development, and
        maintenance of ICT systems. That policy shall:'
      translations:
        fr:
          description: "Dans le cadre des garanties visant \xE0 pr\xE9server la disponibilit\xE9\
            , l\u2019authenticit\xE9, l\u2019int\xE9grit\xE9 et la confidentialit\xE9\
            \ des donn\xE9es, les entit\xE9s financi\xE8res \xE9laborent, documentent\
            \ et mettent en \u0153uvre une politique r\xE9gissant l\u2019acquisition,\
            \ le d\xE9veloppement et la maintenance des syst\xE8mes de TIC. Cette\
            \ politique:"
    - urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:16.1.a
      assessable: true
      depth: 6
      parent_urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:16.1
      ref_id: 16.1.a
      description: identify security practices and methodologies relating to the acquisition,
        development, and maintenance of ICT systems;
      translations:
        fr:
          description: "identifie les pratiques en mati\xE8re de s\xE9curit\xE9 et\
            \ les m\xE9thodes relatives \xE0 l\u2019acquisition, au d\xE9veloppement\
            \ et \xE0 la maintenance des syst\xE8mes de TIC;"
    - urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:16.1.b
      assessable: true
      depth: 6
      parent_urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:16.1
      ref_id: 16.1.b
      description: 'require the identification of:'
      translations:
        fr:
          description: "exige l\u2019identification:"
    - urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:16.1.b.i
      assessable: true
      depth: 7
      parent_urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:16.1.b
      ref_id: 16.1.b.i
      description: technical specifications and ICT technical specifications, as defined
        in Article 2, points (4) and (5), of Regulation (EU) No 1025/2012;
      translations:
        fr:
          description: "des sp\xE9cifications techniques et des sp\xE9cifications\
            \ techniques des TIC, au sens de l\u2019article 2, points 4) et 5), du\
            \ r\xE8glement (UE) no 1025/2012;"
    - urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:16.1.b.ii
      assessable: true
      depth: 7
      parent_urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:16.1.b
      ref_id: 16.1.b.ii
      description: "requirements relating to the acquisition, development, and maintenance\
        \ of ICT systems, with a particular focus on ICT security requirements and\
        \ on their approval by the relevant business function and ICT asset owner\
        \ in accordance with the financial entity\u2019s internal governance arrangements;"
      translations:
        fr:
          description: "des exigences relatives \xE0 l\u2019acquisition, au d\xE9\
            veloppement et \xE0 la maintenance des syst\xE8mes de TIC, en accordant\
            \ une attention particuli\xE8re aux exigences en mati\xE8re de s\xE9curit\xE9\
            \ des TIC et \xE0 leur approbation par la fonction \xABm\xE9tier\xBB concern\xE9\
            e et par le propri\xE9taire des actifs de TIC conform\xE9ment aux dispositifs\
            \ de gouvernance interne de l\u2019entit\xE9 financi\xE8re;"
    - urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:16.1.c
      assessable: true
      depth: 6
      parent_urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:16.1
      ref_id: 16.1.c
      description: specify measures to mitigate the risk of unintentional alteration
        or intentional manipulation of the ICT systems during the development, maintenance,
        and deployment of those ICT systems in the production environment.
      translations:
        fr:
          description: "pr\xE9cise les mesures visant \xE0 att\xE9nuer le risque d\u2019\
            alt\xE9ration involontaire ou de manipulation intentionnelle des syst\xE8\
            mes de TIC lors du d\xE9veloppement, de la maintenance et du d\xE9ploiement\
            \ de ces syst\xE8mes dans l\u2019environnement de production."
    - urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:16.2
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:article-16
      ref_id: '16.2'
      description: "Financial entities shall develop, document, and implement an ICT\
        \ systems\u2019 acquisition, development, and maintenance procedure for the\
        \ testing and approval of all ICT systems prior to their use and after maintenance,\
        \ in accordance with Article 8(2), point (b), points (v), (vi) and (vii).\
        \ The level of testing shall be commensurate to the criticality of the business\
        \ procedures and ICT assets concerned. The testing shall be designed to verify\
        \ that new ICT systems are adequate to perform as intended, including the\
        \ quality of the software developed internally."
      translations:
        fr:
          description: "Les entit\xE9s financi\xE8res \xE9laborent, documentent et\
            \ mettent en \u0153uvre une proc\xE9dure d\u2019acquisition, de d\xE9\
            veloppement et de maintenance des syst\xE8mes de TIC pour les tests et\
            \ l\u2019approbation de tous les syst\xE8mes de TIC avant leur utilisation\
            \ et apr\xE8s les op\xE9rations de maintenance, conform\xE9ment \xE0 l\u2019\
            article 8, paragraphe 2, point b) v), vi) et vii). Le niveau des tests\
            \ doit \xEAtre proportionn\xE9 \xE0 la criticit\xE9 des proc\xE9dures\
            \ op\xE9rationnelles et des actifs de TIC concern\xE9s. Les tests sont\
            \ con\xE7us pour permettre de v\xE9rifier que les nouveaux syst\xE8mes\
            \ de TIC sont aptes \xE0 fonctionner comme pr\xE9vu, ainsi que la qualit\xE9\
            \ du logiciel d\xE9velopp\xE9 en interne."
    - urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:article-16:1
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:article-16
      description: 'Central counterparties shall, in addition to the requirements
        laid down in the first subparagraph, involve, as appropriate, in the design
        and conduct of the testing referred to in the first subparagraph:'
      translations:
        fr:
          description: "En plus de respecter les exigences pr\xE9vues au premier alin\xE9\
            a, les contreparties centrales associent, s\u2019il y a lieu, \xE0 la\
            \ conception et \xE0 la conduite des tests vis\xE9s au premier alin\xE9\
            a:"
    - urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:article-16:1:1
      assessable: true
      depth: 6
      parent_urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:article-16:1
      description: (a)clearing members and clients;
      translations:
        fr:
          description: les membres compensateurs et leurs clients;
    - urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:article-16:1:2
      assessable: true
      depth: 6
      parent_urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:article-16:1
      description: (b)interoperable central counterparties;
      translations:
        fr:
          description: "les contreparties centrales interop\xE9rables;"
    - urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:article-16:1:3
      assessable: true
      depth: 6
      parent_urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:article-16:1
      description: (c)other interested parties.
      translations:
        fr:
          description: "les autres parties int\xE9ress\xE9es."
    - urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:article-16:2
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:article-16
      description: Central securities depositories shall, in addition to the requirements
        laid down in the first subparagraph, involve, as appropriate, in the design
        and conduct of the testing referred to in the first subparagraph
      translations:
        fr:
          description: "En plus de respecter les exigences \xE9nonc\xE9es au premier\
            \ alin\xE9a, les d\xE9positaires centraux de titres associent, s\u2019\
            il y a lieu, \xE0 la conception et \xE0 la conduite des tests vis\xE9\
            s au premier alin\xE9a:"
    - urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:article-16:2:1
      assessable: true
      depth: 6
      parent_urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:article-16:2
      description: (a)users;
      translations:
        fr:
          description: les utilisateurs;
    - urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:article-16:2:2
      assessable: true
      depth: 6
      parent_urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:article-16:2
      description: (b)critical utilities and critical service providers;
      translations:
        fr:
          description: "les prestataires de services et fournisseurs de services de\
            \ r\xE9seau essentiels;"
    - urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:article-16:2:3
      assessable: true
      depth: 6
      parent_urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:article-16:2
      description: (c)other central securities depositories;
      translations:
        fr:
          description: "d\u2019autres d\xE9positaires centraux de titres;"
    - urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:article-16:2:4
      assessable: true
      depth: 6
      parent_urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:article-16:2
      description: (d)other market infrastructures;
      translations:
        fr:
          description: "d\u2019autres infrastructures de march\xE9;"
    - urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:article-16:2:5
      assessable: true
      depth: 6
      parent_urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:article-16:2
      description: '(e)any other institutions with which central securities depositories
        have identified

        interdependencies in their business continuity policy.'
      translations:
        fr:
          description: "d\u2019autres \xE9tablissements avec lesquels les d\xE9positaires\
            \ centraux de titres ont constat\xE9 des interd\xE9pendances dans le cadre\
            \ de leur politique de continuit\xE9 des activit\xE9s."
    - urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:16.3
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:article-16
      ref_id: '16.3'
      description: 'The procedure referred to in paragraph 2 shall contain the performance
        of source code reviews covering both static and dynamic testing. That testing
        shall contain security testing for internet-exposed systems and applications
        in accordance with Article 8(2), point (b), points (v), (vi) and (vii). Financial
        entities shall:'
      translations:
        fr:
          description: "La proc\xE9dure vis\xE9e au paragraphe 2 comprend la r\xE9\
            alisation d\u2019examens du code source comprenant des tests aussi bien\
            \ statiques que dynamiques. Ces tests comprennent des tests de s\xE9curit\xE9\
            \ pour les syst\xE8mes et applications expos\xE9s \xE0 l\u2019internet\
            \ conform\xE9ment \xE0 l\u2019article 8, paragraphe 2, point b) v), vi)\
            \ et vii). Les entit\xE9s financi\xE8res:"
    - urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:16.3.a
      assessable: true
      depth: 6
      parent_urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:16.3
      ref_id: 16.3.a
      description: identify and analyse vulnerabilities and anomalies in the source
        code;
      translations:
        fr:
          description: "identifient et analysent les vuln\xE9rabilit\xE9s et les anomalies\
            \ dans le code source;"
    - urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:16.3.b
      assessable: true
      depth: 6
      parent_urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:16.3
      ref_id: 16.3.b
      description: adopt an action plan to address those vulnerabilities and anomalies;
      translations:
        fr:
          description: "adoptent un plan d\u2019action pour rem\xE9dier \xE0 ces vuln\xE9\
            rabilit\xE9s et anomalies;"
    - urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:16.3.c
      assessable: true
      depth: 6
      parent_urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:16.3
      ref_id: 16.3.c
      description: monitor the implementation of that action plan.
      translations:
        fr:
          description: "suivent la mise en \u0153uvre de ce plan d\u2019action."
    - urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:16.4
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:article-16
      ref_id: '16.4'
      description: The procedure referred to in paragraph 2 shall contain security
        testing of software packages no later than at the integration phase, in accordance
        with Article 8(2), points (b)(v), (vi) and(vii).
      translations:
        fr:
          description: "La proc\xE9dure vis\xE9e au paragraphe 2 comprend des tests\
            \ de s\xE9curit\xE9 des progiciels au plus tard lors de la phase d\u2019\
            int\xE9gration, conform\xE9ment \xE0 l\u2019article 8, paragraphe 2, point\
            \ b) v), vi) et vii)."
    - urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:16.5
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:article-16
      ref_id: '16.5'
      description: 'The procedure referred to in paragraph 2 shall provide that:'
      translations:
        fr:
          description: "La proc\xE9dure vis\xE9e au paragraphe 2 pr\xE9voit que:"
    - urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:16.5.a
      assessable: true
      depth: 6
      parent_urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:16.5
      ref_id: 16.5.a
      description: non-production environments only store anonymised, pseudonymised,
        or randomised production data;
      translations:
        fr:
          description: "les environnements hors production ne stockent que des donn\xE9\
            es de production anonymis\xE9es, pseudonymis\xE9es ou randomis\xE9es;"
    - urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:16.5.b
      assessable: true
      depth: 6
      parent_urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:16.5
      ref_id: 16.5.b
      description: 'financial entities are to protect the integrity and confidentiality
        of data in non-

        production environments.'
      translations:
        fr:
          description: "les entit\xE9s financi\xE8res doivent prot\xE9ger l\u2019\
            int\xE9grit\xE9 et la confidentialit\xE9 des donn\xE9es dans les environnements\
            \ hors production."
    - urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:16.6
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:article-16
      ref_id: '16.6'
      description: By way of derogation from paragraph 5, the procedure referred to
        in paragraph 2 may provide that production data are stored only for specific
        testing occasions, for limited periods of time, and following the approval
        by the relevant function and the reporting of such occasions to the ICT risk
        management function.
      translations:
        fr:
          description: "Par d\xE9rogation au paragraphe 5, la proc\xE9dure vis\xE9\
            e au paragraphe 2 peut pr\xE9voir que les donn\xE9es de production ne\
            \ sont stock\xE9es que pour des situations de test sp\xE9cifiques, pendant\
            \ des dur\xE9es limit\xE9es, et apr\xE8s approbation par la fonction comp\xE9\
            tente et la notification de ces situations \xE0 la fonction de gestion\
            \ du risque li\xE9 aux TIC."
    - urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:16.7
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:article-16
      ref_id: '16.7'
      description: The procedure referred to in paragraph 2 shall contain the implementation
        of controls to protect the integrity of the source code of ICT systems that
        are developed in-house or by an ICT third-party service provider and delivered
        to the financial entity by an ICT third-parties service provider.
      translations:
        fr:
          description: "La proc\xE9dure vis\xE9e au paragraphe 2 comprend la mise\
            \ en \u0153uvre de contr\xF4les visant \xE0 prot\xE9ger l\u2019int\xE9\
            grit\xE9 du code source des syst\xE8mes de TIC qui sont d\xE9velopp\xE9\
            s en interne ou d\xE9velopp\xE9s par un prestataire tiers de services\
            \ TIC et fournis \xE0 l\u2019entit\xE9 financi\xE8re par ce prestataire."
    - urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:16.8
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:article-16
      ref_id: '16.8'
      description: The procedure referred to in paragraph 2 shall provide that proprietary
        software and, where feasible, the source code provided by ICT third-party
        service providers or coming from open-source projects, are to be analysed
        and tested in accordance with paragraph 3 prior to their deployment in the
        production environment.
      translations:
        fr:
          description: "La proc\xE9dure vis\xE9e au paragraphe 2 pr\xE9voit que les\
            \ logiciels propri\xE9taires et, dans la mesure du possible, le code source\
            \ fourni par des prestataires tiers de services TIC ou provenant de projets\
            \ \xE0 code source ouvert doivent \xEAtre analys\xE9s et test\xE9s conform\xE9\
            ment au paragraphe 3 avant leur d\xE9ploiement dans l\u2019environnement\
            \ de production."
    - urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:16.9
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:article-16
      ref_id: '16.9'
      description: Paragraph 1 to 8 of this Article shall also apply to ICT systems
        developed or managed by users outside the ICT function, using a risk-based
        approach.
      translations:
        fr:
          description: "Les paragraphes 1 \xE0 8 du pr\xE9sent article s\u2019appliquent\
            \ \xE9galement aux syst\xE8mes de TIC d\xE9velopp\xE9s ou g\xE9r\xE9s\
            \ par des utilisateurs ext\xE9rieurs \xE0 la fonction TIC, selon une approche\
            \ fond\xE9e sur les risques."
    - urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:article-17
      assessable: false
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:section-7
      ref_id: Article 17
      description: ICT change management
      translations:
        fr:
          description: Gestion des changements dans les TIC
    - urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:17.1
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:article-17
      ref_id: '17.1'
      description: 'As part of the safeguards to preserve the availability, authenticity,
        integrity, and confidentiality of data, financial entities shall include in
        the ICT change management procedures referred to in Article 9(4), point (e),
        of Regulation (EU) 2022/2554, in respect of all changes to software, hardware,
        firmware components, systems, or security parameters, all of the following
        elements:'
      translations:
        fr:
          description: "Dans le cadre des garanties visant \xE0 pr\xE9server la disponibilit\xE9\
            , l\u2019authenticit\xE9, l\u2019int\xE9grit\xE9 et la confidentialit\xE9\
            \ des donn\xE9es, les entit\xE9s financi\xE8res incluent dans les proc\xE9\
            dures de gestion des changements dans les TIC vis\xE9es \xE0 l\u2019article\
            \ 9, paragraphe 4, point e), du r\xE8glement (UE) 2022/2554, en ce qui\
            \ concerne tous les changements apport\xE9s aux logiciels, au mat\xE9\
            riel, aux composants de micrologiciels, aux syst\xE8mes ou aux param\xE8\
            tres de s\xE9curit\xE9, l\u2019ensemble des \xE9l\xE9ments suivants:"
    - urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:17.1.a
      assessable: true
      depth: 6
      parent_urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:17.1
      ref_id: 17.1.a
      description: a verification of whether the ICT security requirements have been
        met;
      translations:
        fr:
          description: "une v\xE9rification du respect des exigences en mati\xE8re\
            \ de s\xE9curit\xE9 des TIC;"
    - urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:17.1.b
      assessable: true
      depth: 6
      parent_urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:17.1
      ref_id: 17.1.b
      description: mechanisms to ensure the independence of the functions that approve
        changes and the functions responsible for requesting and implementing those
        changes;
      translations:
        fr:
          description: "des m\xE9canismes visant \xE0 garantir l\u2019ind\xE9pendance\
            \ des fonctions qui approuvent les changements et des fonctions responsables\
            \ de la demande et de la mise en \u0153uvre de ces changements;"
    - urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:17.1.c
      assessable: true
      depth: 6
      parent_urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:17.1
      ref_id: 17.1.c
      description: 'a clear description of the roles and responsibilities to ensure
        that:'
      translations:
        fr:
          description: "une description claire des r\xF4les et des responsabilit\xE9\
            s afin de garantir:"
    - urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:17.1.c.i
      assessable: true
      depth: 7
      parent_urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:17.1.c
      ref_id: 17.1.c.i
      description: changes are specified and planned;
      translations:
        fr:
          description: "que les changements sont d\xE9finis et planifi\xE9s;"
    - urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:17.1.c.ii
      assessable: true
      depth: 7
      parent_urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:17.1.c
      ref_id: 17.1.c.ii
      description: an adequate transition is designed;
      translations:
        fr:
          description: "qu\u2019une transition ad\xE9quate est con\xE7ue;"
    - urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:17.1.c.iii
      assessable: true
      depth: 7
      parent_urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:17.1.c
      ref_id: 17.1.c.iii
      description: the changes are tested and finalised in a controlled manner;
      translations:
        fr:
          description: "que les changements sont test\xE9s et finalis\xE9s de mani\xE8\
            re contr\xF4l\xE9e;"
    - urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:17.1.c.iv
      assessable: true
      depth: 7
      parent_urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:17.1.c
      ref_id: 17.1.c.iv
      description: there is an effective quality assurance;
      translations:
        fr:
          description: "qu\u2019il existe une assurance de la qualit\xE9 efficace;"
    - urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:17.1.d
      assessable: true
      depth: 6
      parent_urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:17.1
      ref_id: 17.1.d
      description: 'the documentation and communication of change details, including:'
      translations:
        fr:
          description: "la documentation et la communication des d\xE9tails des changements,\
            \ notamment:"
    - urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:17.1.d.i
      assessable: true
      depth: 7
      parent_urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:17.1.d
      ref_id: 17.1.d.i
      description: the purpose and scope of the change;
      translations:
        fr:
          description: "de l\u2019objectif et de la port\xE9e du changement;"
    - urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:17.1.d.ii
      assessable: true
      depth: 7
      parent_urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:17.1.d
      ref_id: 17.1.d.ii
      description: the timeline for the implementation of the change;
      translations:
        fr:
          description: "du calendrier de mise en \u0153uvre du changement;"
    - urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:17.1.d.iii
      assessable: true
      depth: 7
      parent_urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:17.1.d
      ref_id: 17.1.d.iii
      description: the expected outcomes;
      translations:
        fr:
          description: "des r\xE9sultats attendus;"
    - urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:17.1.e
      assessable: true
      depth: 6
      parent_urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:17.1
      ref_id: 17.1.e
      description: the identification of fall-back procedures and responsibilities,
        including procedures and responsibilities for aborting changes or recovering
        from changes not successfully implemented;
      translations:
        fr:
          description: "l\u2019identification des proc\xE9dures et responsabilit\xE9\
            s de repli, notamment des proc\xE9dures et responsabilit\xE9s pour l\u2019\
            abandon des changements ou le r\xE9tablissement \xE0 la suite de changements\
            \ qui n\u2019ont pas \xE9t\xE9 mis en \u0153uvre avec succ\xE8s;"
    - urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:17.1.f
      assessable: true
      depth: 6
      parent_urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:17.1
      ref_id: 17.1.f
      description: procedures, protocols, and tools to manage emergency changes that
        provide adequate safeguards;
      translations:
        fr:
          description: "des proc\xE9dures, protocoles et outils de gestion des changements\
            \ d\u2019urgence qui offrent des garanties ad\xE9quates;"
    - urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:17.1.g
      assessable: true
      depth: 6
      parent_urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:17.1
      ref_id: 17.1.g
      description: procedures to document, re-evaluate, assess, and approve emergency
        changes after their implementation, including workarounds and patches;
      translations:
        fr:
          description: "des proc\xE9dures de documentation, de r\xE9\xE9valuation,\
            \ d\u2019\xE9valuation et d\u2019approbation des changements d\u2019urgence\
            \ apr\xE8s leur mise en \u0153uvre, y compris des solutions de contournement\
            \ et des correctifs;"
    - urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:17.1.h
      assessable: true
      depth: 6
      parent_urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:17.1
      ref_id: 17.1.h
      description: the identification of the potential impact of a change on existing
        ICT security measures and an assessment of whether such change requires the
        adoption of additional ICT security measures.
      translations:
        fr:
          description: "l\u2019identification de l\u2019incidence potentielle d\u2019\
            un changement sur les mesures existantes en mati\xE8re de s\xE9curit\xE9\
            \ des TIC et une \xE9valuation visant \xE0 d\xE9terminer si ce changement\
            \ n\xE9cessite l\u2019adoption de mesures suppl\xE9mentaires en mati\xE8\
            re de s\xE9curit\xE9 des TIC."
    - urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:17.2
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:article-17
      ref_id: '17.2'
      description: After having made significant changes to their ICT systems, central
        counterparties and central securities depositories shall submit their ICT
        systems to stringent testing by simulating stressed conditions.
      translations:
        fr:
          description: "Apr\xE8s avoir apport\xE9 des changements importants \xE0\
            \ leurs syst\xE8mes de TIC, les contreparties centrales et les d\xE9positaires\
            \ centraux de titres soumettent leurs syst\xE8mes de TIC \xE0 des tests\
            \ rigoureux, en simulant des situations de crise."
    - urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:article-17:1
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:article-17
      description: 'Central counterparties shall involve, as appropriate, in the design
        and conduct of the testing referred to in the first subparagraph:'
      translations:
        fr:
          description: "Les contreparties centrales associent, s\u2019il y a lieu,\
            \ \xE0 la conception et \xE0 la conduite des tests vis\xE9s au premier\
            \ alin\xE9a:"
    - urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:article-17:1:1
      assessable: true
      depth: 6
      parent_urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:article-17:1
      description: (a) clearing members and clients;
      translations:
        fr:
          description: les membres compensateurs et leurs clients;
    - urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:article-17:1:2
      assessable: true
      depth: 6
      parent_urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:article-17:1
      description: (b) interoperable central counterparties;
      translations:
        fr:
          description: "les contreparties centrales interop\xE9rables;"
    - urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:article-17:1:3
      assessable: true
      depth: 6
      parent_urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:article-17:1
      description: (c) other interested parties;
      translations:
        fr:
          description: "les autres parties int\xE9ress\xE9es."
    - urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:article-17:2
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:article-17
      description: 'Central securities depositories shall, as appropriate, involve
        in the design and conduct of the testing referred to in the first subparagraph:'
      translations:
        fr:
          description: "Les d\xE9positaires centraux de titres associent, s\u2019\
            il y a lieu, \xE0 la conception et \xE0 la conduite des tests vis\xE9\
            s au premier alin\xE9a:"
    - urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:article-17:2:1
      assessable: true
      depth: 6
      parent_urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:article-17:2
      description: (a) users;
      translations:
        fr:
          description: les utilisateurs;
    - urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:article-17:2:2
      assessable: true
      depth: 6
      parent_urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:article-17:2
      description: (b) critical utilities and critical service providers;
      translations:
        fr:
          description: "les prestataires de services et fournisseurs de services de\
            \ r\xE9seau essentiels;"
    - urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:article-17:2:3
      assessable: true
      depth: 6
      parent_urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:article-17:2
      description: (c) other central securities depositories;
      translations:
        fr:
          description: "d\u2019autres d\xE9positaires centraux de titres;"
    - urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:article-17:2:4
      assessable: true
      depth: 6
      parent_urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:article-17:2
      description: (d) other market infrastructures;
      translations:
        fr:
          description: "d\u2019autres infrastructures de march\xE9;"
    - urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:article-17:2:5
      assessable: true
      depth: 6
      parent_urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:article-17:2
      description: (e) any other institutions with which central securities depositories
        have identified interdependencies in their ICT business continuity policy
      translations:
        fr:
          description: "d\u2019autres \xE9tablissements avec lesquels les d\xE9positaires\
            \ centraux de titres ont constat\xE9 des interd\xE9pendances dans le cadre\
            \ de leur politique de continuit\xE9 des activit\xE9s de TIC."
    - urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:section-8
      assessable: false
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:title-ii:1
      ref_id: SECTION 8
    - urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:article-18
      assessable: false
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:section-8
      ref_id: Article 18
      description: Physical and environmental security
      translations:
        fr:
          description: "S\xE9curit\xE9 physique et environnementale"
    - urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:18.1
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:article-18
      ref_id: '18.1'
      description: As part of the safeguards to preserve the availability, authenticity,
        integrity, and confidentiality of data, financial entities shall specify,
        document, and implement a physical and environmental security policy. Financial
        entities shall design that policy i light of the cyber threat landscape, in
        accordance with the classification established in accordance with Article
        8(1) of Regulation (EU) 2022/2554, and in light of the overall risk profile
        of ICT assets and accessible information assets.
      translations:
        fr:
          description: "Dans le cadre des garanties visant \xE0 pr\xE9server la disponibilit\xE9\
            , l\u2019authenticit\xE9, l\u2019int\xE9grit\xE9 et la confidentialit\xE9\
            \ des donn\xE9es, les entit\xE9s financi\xE8res pr\xE9cisent, documentent\
            \ et mettent en \u0153uvre une politique de s\xE9curit\xE9 physique et\
            \ environnementale. Les entit\xE9s financi\xE8res con\xE7oivent cette\
            \ politique \xE0 la lumi\xE8re de l\u2019\xE9ventail des cybermenaces,\
            \ conform\xE9ment \xE0 la classification \xE9tablie en application de\
            \ l\u2019article 8, paragraphe 1, du r\xE8glement (UE) 2022/2554, et \xE0\
            \ la lumi\xE8re du profil de risque global des actifs de TIC et des actifs\
            \ informationnels accessibles."
    - urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:18.2
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:article-18
      ref_id: '18.2'
      description: 'The physical and environmental security policy referred to in
        paragraph 1 shall contain all of the following:'
      translations:
        fr:
          description: "La politique de s\xE9curit\xE9 physique et environnementale\
            \ vis\xE9e au paragraphe 1 comporte l\u2019ensemble des \xE9l\xE9ments\
            \ suivants:"
    - urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:18.2.a
      assessable: true
      depth: 6
      parent_urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:18.2
      ref_id: 18.2.a
      description: a reference to the section of the policy on control of access management
        rights referred to in Article 21(1) point (g)
      translations:
        fr:
          description: "une r\xE9f\xE9rence \xE0 la section de la politique relative\
            \ au contr\xF4le des droits de gestion des acc\xE8s vis\xE9 \xE0 l\u2019\
            article 21, premier alin\xE9a, point g);"
    - urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:18.2.b
      assessable: true
      depth: 6
      parent_urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:18.2
      ref_id: 18.2.b
      description: measures to protect from attacks, accidents, and environmental
        threats and hazards, the premises, data centres of the financial entity, and
        sensitivedesignated areas identified by the financial entity, where ICT assets
        and information assets reside;
      translations:
        fr:
          description: "des mesures de protection des locaux, des centres de donn\xE9\
            es de l\u2019entit\xE9 financi\xE8re et des zones sensibles d\xE9sign\xE9\
            es par l\u2019entit\xE9 financi\xE8re, o\xF9 se trouvent les actifs de\
            \ TIC et les actifs informationnels, contre les attaques, les accidents\
            \ et les menaces et dangers environnementaux;"
    - urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:18.2.c
      assessable: true
      depth: 6
      parent_urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:18.2
      ref_id: 18.2.c
      description: measures to secure ICT assets, both within and outside the premises
        of the financial entity, taking into account the results of the ICT risk assessment
        related to the relevant ICT assets
      translations:
        fr:
          description: "des mesures visant \xE0 s\xE9curiser les actifs de TIC, tant\
            \ \xE0 l\u2019int\xE9rieur qu\u2019\xE0 l\u2019ext\xE9rieur des locaux\
            \ de l\u2019entit\xE9 financi\xE8re, en tenant compte des r\xE9sultats\
            \ de l\u2019\xE9valuation du risque li\xE9 aux TIC portant sur les actifs\
            \ de TIC concern\xE9s;"
    - urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:18.2.d
      assessable: true
      depth: 6
      parent_urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:18.2
      ref_id: 18.2.d
      description: measures to ensure the availability, authenticity, integrity, and
        confidentiality of ICT assets, information assets, and physical access control
        devices of the financial entity through the appropriate maintenance;
      translations:
        fr:
          description: "des mesures visant \xE0 garantir la disponibilit\xE9, l\u2019\
            authenticit\xE9, l\u2019int\xE9grit\xE9 et la confidentialit\xE9 des actifs\
            \ de TIC, des actifs informationnels et des dispositifs de contr\xF4le\
            \ de l\u2019acc\xE8s physique de l\u2019entit\xE9 financi\xE8re gr\xE2\
            ce \xE0 une maintenance appropri\xE9e;"
    - urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:18.2.e
      assessable: true
      depth: 6
      parent_urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:18.2
      ref_id: 18.2.e
      description: 'measures to preserve the availability, authenticity, integrity,
        and confidentiality of the data, including:'
      translations:
        fr:
          description: "des mesures visant \xE0 pr\xE9server la disponibilit\xE9,\
            \ l\u2019authenticit\xE9, l\u2019int\xE9grit\xE9 et la confidentialit\xE9\
            \ des donn\xE9es, notamment:"
    - urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:18.2.e.i
      assessable: true
      depth: 7
      parent_urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:18.2.e
      ref_id: 18.2.e.i
      description: a clear desk policy for papers;
      translations:
        fr:
          description: une politique du bureau propre pour les documents;
    - urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:18.2.e.ii
      assessable: true
      depth: 7
      parent_urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:18.2.e
      ref_id: 18.2.e.ii
      description: a clear screen policy for information processing facilities.
      translations:
        fr:
          description: "une politique de l\u2019\xE9cran vide pour les installations\
            \ de traitement de l\u2019information."
    - urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:article-18:1
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:article-18
      description: For the purposes of point (b), the measures to protect from environmental
        threats and hazards shall be commensurate with the importance of the premises,
        data centres, sensitive designated areas, and the criticality of the operations
        or ICT systems located therein.
      translations:
        fr:
          description: "Aux fins du point b), les mesures de protection contre les\
            \ menaces et dangers environnementaux sont proportionn\xE9es \xE0 l\u2019\
            importance des locaux, des centres de donn\xE9es, des zones sensibles\
            \ d\xE9sign\xE9es et \xE0 la criticit\xE9 des op\xE9rations ou des syst\xE8\
            mes de TIC qui y sont situ\xE9s."
    - urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:article-18:2
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:article-18
      description: For the purposes of point (c), the physical and environmental security
        policy referred to in paragraph 1 shall contain measures to provide appropriate
        protection to unattended ICT assets.
      translations:
        fr:
          description: "Aux fins du point c), la politique de s\xE9curit\xE9 physique\
            \ et environnementale vis\xE9e au paragraphe 1 comporte des mesures visant\
            \ \xE0 assurer une protection appropri\xE9e des actifs de TIC laiss\xE9\
            s sans surveillance."
    - urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:title-ii:2
      assessable: false
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:title-ii
      name: CHAPTER II
      description: HUMAN RESOURCES POLICY AND ACCESS CONTROL
      translations:
        fr:
          name: CHAPITRE II
          description: "Politique des ressources humaines et contr\xF4le d\u2019acc\xE8\
            s"
    - urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:article-19
      assessable: false
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:title-ii:2
      ref_id: Article 19
      description: Human resources policy
      translations:
        fr:
          description: Politique des ressources humaines
    - urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:article-19:1
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:article-19
      description: 'Financial entities shall include in their human resource policy
        or other relevant policies all of the following ICT security related elements:'
      translations:
        fr:
          description: "Les entit\xE9s financi\xE8res incluent dans leur politique\
            \ en mati\xE8re de ressources humaines ou dans d\u2019autres politiques\
            \ pertinentes tous les \xE9l\xE9ments suivants li\xE9s \xE0 la s\xE9curit\xE9\
            \ des TIC:"
    - urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:19.a
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:article-19:1
      ref_id: 19.a
      description: the identification and assignment of any specific ICT security
        responsibilities;
      translations:
        fr:
          description: "l\u2019identification et l\u2019attribution de toute responsabilit\xE9\
            \ sp\xE9cifique en mati\xE8re de s\xE9curit\xE9 des TIC;"
    - urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:19.b
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:article-19:1
      ref_id: 19.b
      description: 'requirements for staff of the financial entity and of the ICT
        third-party service providers using or accessing ICT assets of the financial
        entity to:'
      translations:
        fr:
          description: "l\u2019obligation pour les membres du personnel de l\u2019\
            entit\xE9 financi\xE8re et des prestataires tiers de services TIC qui\
            \ utilisent des actifs de TIC de l\u2019entit\xE9 financi\xE8re ou qui\
            \ y ont acc\xE8s:"
    - urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:19.b.i
      assessable: true
      depth: 6
      parent_urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:19.b
      ref_id: 19.b.i
      description: be informed about, and adhere to, the financial entity's ICT security
        policies, procedures, and protocols;
      translations:
        fr:
          description: "d\u2019\xEAtre inform\xE9s des politiques, proc\xE9dures et\
            \ protocoles de s\xE9curit\xE9 des TIC de l\u2019entit\xE9 financi\xE8\
            re et de les respecter;"
    - urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:19.b.ii
      assessable: true
      depth: 6
      parent_urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:19.b
      ref_id: 19.b.ii
      description: be aware of the reporting channels put in place by the financial
        entity for the detection of anomalous behaviour, including, where applicable,
        the reporting channels established in line with Directive (EU) 2019/1937 of
        the European Parliament and of the Council10;
      translations:
        fr:
          description: "de conna\xEEtre les canaux de notification mis en place par\
            \ l\u2019entit\xE9 financi\xE8re pour la d\xE9tection des comportements\
            \ anormaux, y compris, le cas \xE9ch\xE9ant, les canaux de signalement\
            \ \xE9tablis conform\xE9ment \xE0 la directive (UE) 2019/1937 du Parlement\
            \ europ\xE9en et du Conseil (11);"
    - urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:19.b.iii
      assessable: true
      depth: 6
      parent_urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:19.b
      ref_id: 19.b.iii
      description: for the staff, to return to the financial entity, upon termination
        of employment, all ICT assets and tangible information assets in their possession
        that belong to the financial entity.
      translations:
        fr:
          description: "de restituer \xE0 l\u2019entit\xE9 financi\xE8re, apr\xE8\
            s la cessation de leur emploi, tous les actifs de TIC et tous les actifs\
            \ informationnels mat\xE9riels en leur possession qui appartiennent \xE0\
            \ l\u2019entit\xE9 financi\xE8re."
    - urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:article-20
      assessable: false
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:title-ii:2
      ref_id: Article 20
      description: Identity management
      translations:
        fr:
          description: "Gestion de l\u2019identit\xE9"
    - urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:20.1
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:article-20
      ref_id: '20.1'
      description: "As part of their control of access management rights, financial\
        \ entities shall develop, document, and implement identity management policies\
        \ and procedures that ensure the unique identification and authentication\
        \ of natural persons and systems accessing the financial entities\u2019 information\
        \ to enable assignment of user access rights in accordance with Article 21."
      translations:
        fr:
          description: "Dans le cadre de leur contr\xF4le des droits de gestion des\
            \ acc\xE8s, les entit\xE9s financi\xE8res \xE9laborent, documentent et\
            \ mettent en \u0153uvre des politiques et proc\xE9dures de gestion de\
            \ l\u2019identit\xE9 qui garantissent l\u2019identification et l\u2019\
            authentification uniques des personnes physiques et des syst\xE8mes ayant\
            \ acc\xE8s aux informations des entit\xE9s financi\xE8res afin de permettre\
            \ l\u2019attribution de droits d\u2019acc\xE8s aux utilisateurs conform\xE9\
            ment \xE0 l\u2019article 21."
    - urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:20.2
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:article-20
      ref_id: '20.2'
      description: 'The identity management policies and procedures referred to in
        paragraph 1 shall contain all of the following:'
      translations:
        fr:
          description: "Les politiques et proc\xE9dures de gestion de l\u2019identit\xE9\
            \ vis\xE9es au paragraphe 1 comportent l\u2019ensemble des \xE9l\xE9ments\
            \ suivants:"
    - urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:20.2.a
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:20.2
      ref_id: 20.2.a
      description: without prejudice to Article 21(1), point (c), a unique identity
        corresponding to a unique user account shall be assigned to each staff member
        of the financial entity or staff of the ICT third-party service providers
        accessing the information assets and ICT assets of the financial entity;
      translations:
        fr:
          description: "sans pr\xE9judice de l\u2019article 21, premier alin\xE9a,\
            \ point c), une identit\xE9 unique correspondant \xE0 un compte d\u2019\
            utilisateur unique est attribu\xE9e \xE0 chaque membre du personnel de\
            \ l\u2019entit\xE9 financi\xE8re ou du personnel des prestataires tiers\
            \ de services TIC qui ont acc\xE8s aux actifs informationnels et aux actifs\
            \ de TIC de l\u2019entit\xE9 financi\xE8re;"
    - urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:20.2.b
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:20.2
      ref_id: 20.2.b
      description: a lifecycle management process for identities and accounts managing
        the creation, change, review and update, temporary deactivation, and termination
        of all accounts.
      translations:
        fr:
          description: "un processus de gestion du cycle de vie pour les identit\xE9\
            s et les comptes r\xE9gissant la cr\xE9ation, la modification, le r\xE9\
            examen et la mise \xE0 jour, la d\xE9sactivation temporaire et la cl\xF4\
            ture de tous les comptes."
    - urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:article-20:1
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:article-20
      description: For the purposes of point (a), financial entities shall maintain
        records of all identity assignments. Those records shall be kept following
        a reorganisation of the financial entity or after the end of the contractual
        relationship without prejudice to the retention requirements laid down in
        applicable Union and national law.
      translations:
        fr:
          description: "Aux fins du point a), les entit\xE9s financi\xE8res tiennent\
            \ des registres de toutes les attributions d\u2019identit\xE9. Ces registres\
            \ sont conserv\xE9s \xE0 la suite d\u2019une r\xE9organisation de l\u2019\
            entit\xE9 financi\xE8re ou apr\xE8s la fin d\u2019une relation contractuelle,\
            \ sans pr\xE9judice des exigences en mati\xE8re de conservation pr\xE9\
            vues par le droit de l\u2019Union et le droit national applicables."
    - urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:article-20:2
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:article-20
      description: For the purposes of point (b), financial entities shall, where
        feasible and appropriate, deploy automated solutions for the lifecycle identity
        management process.
      translations:
        fr:
          description: "Aux fins du point b), les entit\xE9s financi\xE8res d\xE9\
            ploient, lorsque cela est possible et appropri\xE9, des solutions automatis\xE9\
            es pour le processus de gestion de l\u2019identit\xE9 tout au long du\
            \ cycle de vie."
    - urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:article-21
      assessable: false
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:title-ii:2
      ref_id: Article 21
      description: Access control
      translations:
        fr:
          description: "Contr\xF4le d\u2019acc\xE8s"
    - urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:article-21:1
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:article-21
      description: 'As part of their control of access management rights, financial
        entities shall develop, document, and implement a policy that contains all
        of the following:'
      translations:
        fr:
          description: "Dans le cadre de leur contr\xF4le des droits de gestion des\
            \ acc\xE8s, les entit\xE9s financi\xE8res \xE9laborent, documentent et\
            \ mettent en \u0153uvre une politique qui comporte l\u2019ensemble des\
            \ \xE9l\xE9ments suivants:"
    - urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:21.a
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:article-21:1
      ref_id: 21.a
      description: the assignment of access rights to ICT assets based on need-to-know,
        need-to-use and least privilege principles, including for remote and emergency
        access;
      translations:
        fr:
          description: "l\u2019attribution de droits d\u2019acc\xE8s aux actifs de\
            \ TIC selon les principes du besoin d\u2019en conna\xEEtre, du besoin\
            \ d\u2019en disposer et du moindre privil\xE8ge, y compris pour l\u2019\
            acc\xE8s \xE0 distance et l\u2019acc\xE8s d\u2019urgence;"
    - urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:21.b
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:article-21:1
      ref_id: 21.b
      description: the segregation of duties designed to prevent unjustified access
        to critical data or to prevent the allocation of combinations of access rights
        that may be used to circumvent controls;
      translations:
        fr:
          description: "une s\xE9paration des t\xE2ches visant \xE0 emp\xEAcher un\
            \ acc\xE8s injustifi\xE9 \xE0 des donn\xE9es critiques ou \xE0 emp\xEA\
            cher l\u2019attribution de combinaisons de droits d\u2019acc\xE8s susceptibles\
            \ d\u2019\xEAtre utilis\xE9es pour contourner les contr\xF4les;"
    - urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:21.c
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:article-21:1
      ref_id: 21.c
      description: a provision on user accountability, by limiting to the extent possible
        the use of generic and shared user accounts and ensuring that users are identifiable
        for the actions performed in the ICT systems at all times;
      translations:
        fr:
          description: "des dispositions sur la responsabilit\xE9 des utilisateurs,\
            \ en limitant, dans la mesure du possible, l\u2019utilisation de comptes\
            \ utilisateurs g\xE9n\xE9riques ou partag\xE9s et en veillant \xE0 ce\
            \ que les utilisateurs soient \xE0 tout moment identifiables pour les\
            \ actions effectu\xE9es dans les syst\xE8mes de TIC;"
    - urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:21.d
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:article-21:1
      ref_id: 21.d
      description: a provision on restrictions of access to ICT assets, setting out
        controls and tools to prevent unauthorised access;
      translations:
        fr:
          description: "des dispositions sur les restrictions d\u2019acc\xE8s aux\
            \ actifs de TIC, pr\xE9voyant des contr\xF4les et des outils pour emp\xEA\
            cher tout acc\xE8s non autoris\xE9;"
    - urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:21.e
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:article-21:1
      ref_id: 21.e
      description: 'account management procedures to grant, change or revoke access
        rights for user and generic accounts, including generic administrator accounts,
        including provision on all of the following:'
      translations:
        fr:
          description: "des proc\xE9dures de gestion de comptes permettant d\u2019\
            accorder, de modifier ou de r\xE9voquer des droits d\u2019acc\xE8s pour\
            \ les comptes d\u2019utilisateurs et les comptes g\xE9n\xE9riques, y compris\
            \ les comptes g\xE9n\xE9riques d\u2019administrateur, comportant des dispositions\
            \ relatives \xE0 tous les \xE9l\xE9ments suivants:"
    - urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:21.e.i
      assessable: true
      depth: 6
      parent_urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:21.e
      ref_id: 21.e.i
      description: assignment of roles and responsibilities for granting, reviewing,
        and revoking access rights;
      translations:
        fr:
          description: "l\u2019attribution des r\xF4les et des responsabilit\xE9s\
            \ pour l\u2019octroi, le r\xE9examen et la r\xE9vocation des droits d\u2019\
            acc\xE8s;"
    - urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:21.e.ii
      assessable: true
      depth: 6
      parent_urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:21.e
      ref_id: 21.e.ii
      description: assignment of privileged, emergency, and administrator access on
        a need-to-use or an ad-hoc basis for all ICT systems;
      translations:
        fr:
          description: "l\u2019attribution d\u2019acc\xE8s privil\xE9gi\xE9s, d\u2019\
            urgence et d\u2019administrateur uniquement sur la base du besoin d\u2019\
            en disposer ou au cas par cas pour tous les syst\xE8mes de TIC;"
    - urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:21.e.iii
      assessable: true
      depth: 6
      parent_urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:21.e
      ref_id: 21.e.iii
      description: withdrawal of access rights without undue delay upon termination
        of the employment or when the access is no longer necessary;
      translations:
        fr:
          description: "le retrait des droits d\u2019acc\xE8s sans retard injustifi\xE9\
            \ \xE0 la fin de l\u2019emploi ou lorsque l\u2019acc\xE8s n\u2019est plus\
            \ n\xE9cessaire;"
    - urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:21.e.iv
      assessable: true
      depth: 6
      parent_urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:21.e
      ref_id: 21.e.iv
      description: update of access rights where changes are necessary and at least
        once a year for all ICT systems, other than ICT systems supporting critical
        or important functions and at least every 6 months for ICT systems supporting
        critical or important functions.
      translations:
        fr:
          description: "la mise \xE0 jour des droits d\u2019acc\xE8s lorsque des modifications\
            \ sont n\xE9cessaires et au moins une fois par an pour tous les syst\xE8\
            mes de TIC autres que les syst\xE8mes de TIC qui soutiennent des fonctions\
            \ critiques ou importantes et au moins tous les six mois pour les syst\xE8\
            mes de TIC qui soutiennent des fonctions critiques ou importantes;"
    - urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:21.f
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:article-21:1
      ref_id: 21.f
      description: 'authentication methods, including all of the following:'
      translations:
        fr:
          description: "des m\xE9thodes d\u2019authentification, comprenant l\u2019\
            ensemble des \xE9l\xE9ments suivants:"
    - urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:21.f.i
      assessable: true
      depth: 6
      parent_urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:21.f
      ref_id: 21.f.i
      description: the use of authentication methods commensurate to the classification
        established in accordance with Article 8(1) of Regulation (EU) 2022/2554 and
        to the overall risk profile of ICT assets and considering leading practices;
      translations:
        fr:
          description: "l\u2019utilisation de m\xE9thodes d\u2019authentification\
            \ proportionn\xE9es \xE0 la classification \xE9tablie conform\xE9ment\
            \ \xE0 l\u2019article 8, paragraphe 1, du r\xE8glement (UE) 2022/2554\
            \ et au profil de risque global des actifs de TIC et tenant compte des\
            \ pratiques de pointe;"
    - urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:21.f.ii
      assessable: true
      depth: 6
      parent_urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:21.f
      ref_id: 21.f.ii
      description: the use of strong authentication methods in accordance with leading
        practices and techniques for remote access to the financial entity's network,
        for privileged access, for access to ICT assets supporting critical or important
        functions or ICT assets that are publicly accessible;
      translations:
        fr:
          description: "l\u2019utilisation de m\xE9thodes d\u2019authentification\
            \ forte conform\xE9ment aux pratiques et techniques de pointe pour l\u2019\
            acc\xE8s \xE0 distance au r\xE9seau de l\u2019entit\xE9 financi\xE8re,\
            \ pour les acc\xE8s privil\xE9gi\xE9s, pour l\u2019acc\xE8s aux actifs\
            \ de TIC soutenant des fonctions critiques ou importantes ou aux actifs\
            \ de TIC accessibles au public;"
    - urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:21.g
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:article-21:1
      ref_id: 21.g
      description: 'physical access controls measures including:'
      translations:
        fr:
          description: "des mesures de contr\xF4le de l\u2019acc\xE8s physique comprenant:"
    - urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:21.g.i
      assessable: true
      depth: 6
      parent_urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:21.g
      ref_id: 21.g.i
      description: the identification and logging of natural persons that are authorised
        to access premises, data centres, and sensitive designated areas identified
        by the financial entity where ICT and information assets reside;
      translations:
        fr:
          description: "l\u2019identification et la journalisation des personnes physiques\
            \ autoris\xE9es \xE0 acc\xE9der aux locaux, aux centres de donn\xE9es\
            \ et aux zones sensibles d\xE9sign\xE9es par l\u2019entit\xE9 financi\xE8\
            re o\xF9 sont situ\xE9s les actifs de TIC et les actifs informationnels;"
    - urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:21.g.ii
      assessable: true
      depth: 6
      parent_urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:21.g
      ref_id: 21.g.ii
      description: the granting of physical access rights to critical ICT assets to
        authorised persons only, in accordance with the need-to-know and least privilege
        principles, and on an ad-hoc basis;
      translations:
        fr:
          description: "l\u2019octroi de droits d\u2019acc\xE8s physique aux actifs\
            \ de TIC critiques uniquement aux personnes autoris\xE9es, conform\xE9\
            ment aux principes du besoin d\u2019en conna\xEEtre et du moindre privil\xE8\
            ge, et au cas par cas;"
    - urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:21.g.iii
      assessable: true
      depth: 6
      parent_urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:21.g
      ref_id: 21.g.iii
      description: the monitoring of physical access to premises, data centres, and
        sensitive designated areas identified by the financial entity where ICT and
        information assets or both reside;
      translations:
        fr:
          description: "le suivi de l\u2019acc\xE8s physique aux locaux, aux centres\
            \ de donn\xE9es et aux zones sensibles d\xE9sign\xE9es par l\u2019entit\xE9\
            \ financi\xE8re o\xF9 sont situ\xE9s les actifs de TIC, les actifs informationnels\
            \ ou les deux types d\u2019actifs;"
    - urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:21.g.iv
      assessable: true
      depth: 6
      parent_urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:21.g
      ref_id: 21.g.iv
      description: the review of physical access rights to ensure that unnecessary
        access rights are promptly revoked.
      translations:
        fr:
          description: "le r\xE9examen des droits d\u2019acc\xE8s physique afin de\
            \ veiller \xE0 ce que les droits d\u2019acc\xE8s inutiles soient rapidement\
            \ r\xE9voqu\xE9s."
    - urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:article-21:2
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:article-21
      description: For the purposes of point (e)(i), financial entities shall establish
        the retention period taking into account the business and information security
        objectives, the reasons for recording the event in the logs, and the results
        of the ICT risk assessment.
      translations:
        fr:
          description: "Aux fins du point e) i), les entit\xE9s financi\xE8res d\xE9\
            finissent la dur\xE9e de conservation en prenant en consid\xE9ration les\
            \ objectifs en mati\xE8re de s\xE9curit\xE9 des activit\xE9s et de l\u2019\
            information, les raisons de l\u2019enregistrement de l\u2019\xE9v\xE9\
            nement dans les journaux et les r\xE9sultats de l\u2019\xE9valuation du\
            \ risque li\xE9 aux TIC."
    - urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:article-21:3
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:article-21
      description: For the purposes of point (e)(ii), financial entities shall, where
        possible, use dedicated accounts for the performance of administrative tasks
        on ICT systems. Where feasible and appropriate, financial entities shall deploy
        automated solutions for the privilege access management.
      translations:
        fr:
          description: "Aux fins du point e) ii), les entit\xE9s financi\xE8res utilisent,\
            \ dans la mesure du possible, des comptes sp\xE9cifiques pour l\u2019\
            ex\xE9cution de t\xE2ches administratives relatives aux syst\xE8mes de\
            \ TIC. Lorsque cela est possible et appropri\xE9, les entit\xE9s financi\xE8\
            res d\xE9ploient des solutions automatis\xE9es pour la gestion des acc\xE8\
            s privil\xE9gi\xE9s."
    - urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:article-21:4
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:article-21
      description: For the purposes of point (g)(i), the identification and logging
        shall be commensurate with the importance of the premises, data centres, sensitive
        designated areas, and the criticality of the operations or ICT systems located
        therein.
      translations:
        fr:
          description: "Aux fins du point g) i), l\u2019identification et la journalisation\
            \ sont proportionn\xE9es \xE0 l\u2019importance des locaux, des centres\
            \ de donn\xE9es et des zones sensibles d\xE9sign\xE9es et \xE0 la criticit\xE9\
            \ des op\xE9rations ou des syst\xE8mes de TIC qui y sont situ\xE9s."
    - urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:article-21:5
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:article-21
      description: For the purposes of point (g)(iii), the monitoring shall be commensurate
        to the classification established in accordance with Article 8(1) of Regulation
        (EU) 2022/2554 and the criticality of the area accessed.
      translations:
        fr:
          description: "Aux fins du point g) iii), le suivi est proportionn\xE9 \xE0\
            \ la classification \xE9tablie conform\xE9ment \xE0 l\u2019article 8,\
            \ paragraphe 1, du r\xE8glement (UE) 2022/2554 et \xE0 la criticit\xE9\
            \ de la zone accessible."
    - urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:title-ii:3
      assessable: false
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:title-ii
      name: CHAPTER III
      description: ICT-RELATED INCIDENT DETECTION AND RESPONSE
      translations:
        fr:
          name: CHAPITRE III
          description: "D\xE9tection des incidents li\xE9s aux TIC et r\xE9ponse \xE0\
            \ ces incidents"
    - urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:article-22
      assessable: false
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:title-ii:3
      ref_id: Article 22
      description: ICT-related incident management policy
      translations:
        fr:
          description: "Politique de gestion des incidents li\xE9s aux TIC"
    - urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:article-22:1
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:article-22
      description: 'As part of the mechanisms to detect anomalous activities, including
        ICT network performance issues and ICT-related incidents, financial entities
        shall develop, document, and implement an ICT-related incident policy through
        which they shall:'
      translations:
        fr:
          description: "Dans le cadre des m\xE9canismes de d\xE9tection des activit\xE9\
            s anormales, y compris des probl\xE8mes de performance des r\xE9seaux\
            \ de TIC et des incidents li\xE9s aux TIC, les entit\xE9s financi\xE8\
            res \xE9laborent, documentent et mettent en \u0153uvre une politique en\
            \ mati\xE8re d\u2019incidents li\xE9s aux TIC dans le cadre de laquelle\
            \ elles:"
    - urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:22.a
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:article-22:1
      ref_id: 22.a
      description: document the ICT-related incident management process referred to
        in Article 17 of Regulation (EU) 2022/2554;
      translations:
        fr:
          description: "documentent le processus de gestion des incidents li\xE9s\
            \ aux TIC vis\xE9 \xE0 l\u2019article 17 du r\xE8glement (UE) 2022/2554;"
    - urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:22.b
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:article-22:1
      ref_id: 22.b
      description: 'establish a list of relevant contacts with internal functions
        and external stakeholders that are directly involved in ICT operations security,
        including on:'
      translations:
        fr:
          description: "\xE9tablissent une liste des contacts pertinents avec les\
            \ fonctions internes et les parties prenantes externes qui sont directement\
            \ associ\xE9es \xE0 la s\xE9curit\xE9 des op\xE9rations de TIC, notamment\
            \ en ce qui concerne:"
    - urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:22.b.i
      assessable: true
      depth: 6
      parent_urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:22.b
      ref_id: 22.b.i
      description: the detection and monitoring of cyber threats;
      translations:
        fr:
          description: "la d\xE9tection et le suivi des cybermenaces;"
    - urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:22.b.ii
      assessable: true
      depth: 6
      parent_urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:22.b
      ref_id: 22.b.ii
      description: the detection of anomalous activities;
      translations:
        fr:
          description: "la d\xE9tection des activit\xE9s anormales;"
    - urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:22.b.iii
      assessable: true
      depth: 6
      parent_urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:22.b
      ref_id: 22.b.iii
      description: vulnerability management;
      translations:
        fr:
          description: "la gestion des vuln\xE9rabilit\xE9s;"
    - urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:22.c
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:article-22:1
      ref_id: 22.c
      description: establish, implement, and operate technical, organisational, and
        operational mechanisms to support the ICT-related incident management process,
        including mechanisms to enable a prompt detection of anomalous activities
        and behaviours in accordance with Article 23 of this Regulation;
      translations:
        fr:
          description: "\xE9tablissent, mettent en \u0153uvre et g\xE8rent des m\xE9\
            canismes techniques, organisationnels et op\xE9rationnels pour soutenir\
            \ le processus de gestion des incidents li\xE9s aux TIC, notamment des\
            \ m\xE9canismes permettant de d\xE9tecter rapidement les activit\xE9s\
            \ et comportements anormaux conform\xE9ment \xE0 l\u2019article 23 du\
            \ pr\xE9sent r\xE8glement;"
    - urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:22.d
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:article-22:1
      ref_id: 22.d
      description: "retain all evidence relating to ICT-related incidents for a period\
        \ that shall be no longer than necessary for the purposes for which the data\
        \ are collected, commensurate with the criticality of the affected business\
        \ functions, supporting processes, and ICT and information assets, in accordance\
        \ with [Article [15] of Commission Delegated Regulation (EU) [\u2026]/[\u2026\
        ] [Commission Delegated Regulation on classification of ICT- related incidents]11\
        \ and with any applicable retention requirement pursuant to Union law;"
      translations:
        fr:
          description: "conservent tous les \xE9l\xE9ments de preuve relatifs aux\
            \ incidents li\xE9s aux TIC pendant une dur\xE9e qui n\u2019exc\xE8de\
            \ pas celle n\xE9cessaire \xE0 la r\xE9alisation des finalit\xE9s pour\
            \ lesquelles les donn\xE9es sont collect\xE9es, et qui est proportionn\xE9\
            e \xE0 la criticit\xE9 des fonctions \xABm\xE9tiers\xBB, des processus\
            \ d\u2019appui et des actifs de TIC et informationnels affect\xE9s, conform\xE9\
            ment \xE0 l\u2019article 15 du r\xE8glement d\xE9l\xE9gu\xE9 (UE) 2024/1772\
            \ de la Commission (12) et \xE0 toute exigence en mati\xE8re de conservation\
            \ applicable en vertu du droit de l\u2019Union;"
    - urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:22.e
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:article-22:1
      ref_id: 22.e
      description: establish and implement mechanisms to analyse significant or recurring
        ICT-related incidents and patterns in the number and the occurrence of ICT-related
        incidents.
      translations:
        fr:
          description: "\xE9tablissent et mettent en \u0153uvre des m\xE9canismes\
            \ permettant d\u2019analyser les incidents importants ou r\xE9currents\
            \ li\xE9s aux TIC et les caract\xE9ristiques relatives au nombre et \xE0\
            \ la fr\xE9quence des incidents li\xE9s aux TIC."
    - urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:article-22:2
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:article-22
      description: For the purposes of point (d), financial entities shall retain
        the evidence referred to in that point in a secure manner.
      translations:
        fr:
          description: "Aux fins du point d), les entit\xE9s financi\xE8res conservent\
            \ les \xE9l\xE9ments de preuve vis\xE9s audit point de mani\xE8re s\xE9\
            curis\xE9e aux fins dudit point."
    - urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:article-23
      assessable: false
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:title-ii:3
      ref_id: Article 23
      description: Anomalous activities detection and criteria for ICT-related incidents
        detection and response
      translations:
        fr:
          description: "D\xE9tection des activit\xE9s anormales et crit\xE8res pour\
            \ la d\xE9tection des incidents li\xE9s aux TIC et la r\xE9ponse \xE0\
            \ ces incidents"
    - urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:23.1
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:article-23
      ref_id: '23.1'
      description: Financial entities shall set clear roles and responsibilities to
        effectively detect and respond to ICT-related incidents and anomalous activities.
      translations:
        fr:
          description: "Les entit\xE9s financi\xE8res d\xE9finissent clairement les\
            \ r\xF4les et les responsabilit\xE9s pour ce qui est de d\xE9tecter efficacement\
            \ les incidents li\xE9s aux TIC et les activit\xE9s anormales et d\u2019\
            y r\xE9pondre."
    - urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:23.2
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:article-23
      ref_id: '23.2'
      description: 'The mechanism to promptly detect anomalous activities, including
        ICT network performance issues and ICT-related incidents, as referred to in
        Article 10(1) of Regulation (EU) 2022/2554, shall enable financial entities
        to:'
      translations:
        fr:
          description: "Le m\xE9canisme permettant de d\xE9tecter rapidement les activit\xE9\
            s anormales, y compris les probl\xE8mes de performance des r\xE9seaux\
            \ de TIC et les incidents li\xE9s aux TIC, vis\xE9 \xE0 l\u2019article\
            \ 10, paragraphe 1, du r\xE8glement (UE) 2022/2554, permet aux entit\xE9\
            s financi\xE8res:"
    - urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:23.2.a
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:23.2
      ref_id: 23.2.a
      description: 'collect, monitor, and analyse all of the following:'
      translations:
        fr:
          description: "de collecter, suivre et analyser l\u2019ensemble des \xE9\
            l\xE9ments suivants:"
    - urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:23.2.a.i
      assessable: true
      depth: 6
      parent_urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:23.2.a
      ref_id: 23.2.a.i
      description: internal and external factors, including at least the logs collected
        in accordance with Article 12 of this Regulation, information from business
        and ICT functions, and any problem reported by users of the financial entity;
      translations:
        fr:
          description: "les facteurs internes et externes, y compris au moins les\
            \ journaux collect\xE9s conform\xE9ment \xE0 l\u2019article 12 du pr\xE9\
            sent r\xE8glement, les informations provenant des fonctions \xABm\xE9\
            tiers\xBB et des fonctions TIC, et tout probl\xE8me signal\xE9 par les\
            \ utilisateurs de l\u2019entit\xE9 financi\xE8re;"
    - urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:23.2.a.ii
      assessable: true
      depth: 6
      parent_urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:23.2.a
      ref_id: 23.2.a.ii
      description: potential internal and external cyber threats, considering scenarios
        commonly used by threat actors and scenarios based on threat intelligence
        activity;
      translations:
        fr:
          description: "les cybermenaces potentielles internes et externes, en tenant\
            \ compte des sc\xE9narios couramment utilis\xE9s par les acteurs de la\
            \ menace et des sc\xE9narios fond\xE9s sur les activit\xE9s de renseignement\
            \ sur les menaces;"
    - urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:23.2.a.iii
      assessable: true
      depth: 6
      parent_urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:23.2.a
      ref_id: 23.2.a.iii
      description: ICT-related incident notification from an ICT third-party service
        provider of the financial entity detected in the ICT systems and networks
        of the ICT third-party service provider and that may affect the financial
        entity;
      translations:
        fr:
          description: "les notifications, par un prestataire tiers de services TIC\
            \ de l\u2019entit\xE9 financi\xE8re, d\u2019incidents li\xE9s aux TIC\
            \ d\xE9tect\xE9s dans les syst\xE8mes et r\xE9seaux de TIC du prestataire\
            \ tiers de services TIC et susceptibles d\u2019affecter l\u2019entit\xE9\
            \ financi\xE8re;"
    - urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:23.2.b
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:23.2
      ref_id: 23.2.b
      description: identify anomalous activities and behaviour, and implement tools
        generating alerts for anomalous activities and behaviour, at least for ICT
        assets and information assets supporting critical or important functions;
      translations:
        fr:
          description: "d\u2019identifier les activit\xE9s et les comportements anormaux\
            \ et de mettre en \u0153uvre des outils g\xE9n\xE9rant des alertes pour\
            \ les activit\xE9s et comportements anormaux, au moins pour les actifs\
            \ de TIC et les actifs informationnels qui soutiennent des fonctions critiques\
            \ ou importantes;"
    - urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:23.2.c
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:23.2
      ref_id: 23.2.c
      description: prioritise the alerts referred to in point (b) to allow for the
        management of the detected ICT-related incidents within the expected resolution
        time, as specified by financial entities, both during and outside working
        hours;
      translations:
        fr:
          description: "de hi\xE9rarchiser les alertes vis\xE9es au point b) afin\
            \ de permettre que les incidents li\xE9s aux TIC d\xE9tect\xE9s soient\
            \ g\xE9r\xE9s dans le d\xE9lai de r\xE9solution pr\xE9vu, tel que sp\xE9\
            cifi\xE9 par les entit\xE9s financi\xE8res, tant pendant les heures de\
            \ travail qu\u2019en dehors de celles-ci;"
    - urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:23.2.d
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:23.2
      ref_id: 23.2.d
      description: record, analyse, and evaluate any relevant information on all anomalous
        activities and behaviours automatically or manually.
      translations:
        fr:
          description: "d\u2019enregistrer, analyser et \xE9valuer, automatiquement\
            \ ou manuellement, toutes les informations pertinentes sur l\u2019ensemble\
            \ des activit\xE9s et comportements anormaux."
    - urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:article-23:1
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:article-23
      description: For the purposes of point (b), the tools referred to in that point
        shall contain the tools that provide automated alerts based on pre-defined
        rules to identify anomalies affecting the completeness and integrity of the
        data sources or log collection.
      translations:
        fr:
          description: "Aux fins du point b), les outils vis\xE9s audit point comprennent\
            \ des outils qui fournissent des alertes automatis\xE9es selon des r\xE8\
            gles pr\xE9d\xE9finies afin de d\xE9tecter les anomalies affectant l\u2019\
            exhaustivit\xE9 et l\u2019int\xE9grit\xE9 des sources de donn\xE9es ou\
            \ de la collecte de journaux."
    - urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:23.3
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:article-23
      ref_id: '23.3'
      description: Financial entities shall protect any recording of the anomalous
        activities against tampering and unauthorised access at rest, in transit and,
        where relevant, in use.
      translations:
        fr:
          description: "Les entit\xE9s financi\xE8res prot\xE8gent tout enregistrement\
            \ d\u2019activit\xE9s anormales contre toute falsification et tout acc\xE8\
            s non autoris\xE9 au repos, en transit et, le cas \xE9ch\xE9ant, en cours\
            \ d\u2019utilisation."
    - urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:23.4
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:article-23
      ref_id: '23.4'
      description: 'Financial entities shall log all relevant information for each
        detected anomalous activity enabling:'
      translations:
        fr:
          description: "Les entit\xE9s financi\xE8res journalisent, pour chaque activit\xE9\
            \ anormale d\xE9tect\xE9e, toutes les informations pertinentes permettant:"
    - urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:23.4.a
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:23.4
      ref_id: 23.4.a
      description: the identification of the date and time of occurrence of the anomalous
        activity;
      translations:
        fr:
          description: "de d\xE9terminer la date et l\u2019heure de survenance de\
            \ l\u2019activit\xE9 anormale;"
    - urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:23.4.b
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:23.4
      ref_id: 23.4.b
      description: the identification of the date and time of detection of the anomalous
        activity;
      translations:
        fr:
          description: "de d\xE9terminer la date et l\u2019heure de d\xE9tection de\
            \ l\u2019activit\xE9 anormale;"
    - urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:23.4.c
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:23.4
      ref_id: 23.4.c
      description: the identification of the type of the anomalous activity.
      translations:
        fr:
          description: "de d\xE9terminer le type d\u2019activit\xE9 anormale."
    - urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:23.5
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:article-23
      ref_id: '23.5'
      description: 'Financial entities shall consider all of the following criteria
        to trigger the ICT-related incident detection and response processes referred
        to in Article 10(2) of Regulation (EU) 2022/2554:'
      translations:
        fr:
          description: "Pour d\xE9clencher les processus de d\xE9tection des incidents\
            \ li\xE9s aux TIC et de r\xE9ponse \xE0 ces incidents vis\xE9s \xE0 l\u2019\
            article 10, paragraphe 2, du r\xE8glement (UE) 2022/2554, les entit\xE9\
            s financi\xE8res tiennent compte de l\u2019ensemble des crit\xE8res suivants:"
    - urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:23.5.a
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:23.5
      ref_id: 23.5.a
      description: indications that malicious activity may have been carried out in
        an ICT system or network, or that such ICT system or network may have been
        compromised;
      translations:
        fr:
          description: "des \xE9l\xE9ments indiquant qu\u2019une activit\xE9 malveillante\
            \ est susceptible d\u2019avoir \xE9t\xE9 men\xE9e dans un syst\xE8me ou\
            \ un r\xE9seau de TIC, ou que ce syst\xE8me ou r\xE9seau de TIC est susceptible\
            \ d\u2019avoir \xE9t\xE9 compromis;"
    - urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:23.5.b
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:23.5
      ref_id: 23.5.b
      description: data losses detected in relation to the availability, authenticity,
        integrity, and confidentiality of data;
      translations:
        fr:
          description: "des pertes de donn\xE9es d\xE9tect\xE9es en lien avec la disponibilit\xE9\
            , l\u2019authenticit\xE9, l\u2019int\xE9grit\xE9 et la confidentialit\xE9\
            \ des donn\xE9es;"
    - urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:23.5.c
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:23.5
      ref_id: 23.5.c
      description: adverse impact detected on financial entity's transactions and
        operations;
      translations:
        fr:
          description: "une incidence n\xE9gative d\xE9tect\xE9e sur les transactions\
            \ et op\xE9rations de l\u2019entit\xE9 financi\xE8re;"
    - urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:23.5.d
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:23.5
      ref_id: 23.5.d
      description: "ICT systems\u2019 and network unavailability;"
      translations:
        fr:
          description: "l\u2019indisponibilit\xE9 des syst\xE8mes et r\xE9seaux de\
            \ TIC."
    - urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:23.6
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:article-23
      ref_id: '23.6'
      description: For the purposes of paragraph 5, financial entities shall also
        consider the criticality of the services affected.
      translations:
        fr:
          description: "Aux fins du paragraphe 5, les entit\xE9s financi\xE8res tiennent\
            \ \xE9galement compte de la criticit\xE9 des services affect\xE9s."
    - urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:title-ii:4
      assessable: false
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:title-ii
      name: CHAPTER IV
      description: ICT BUSINESS CONTINUITY MANAGEMENT
      translations:
        fr:
          name: CHAPITRE IV
          description: "Gestion de la continuit\xE9 des activit\xE9s de TIC"
    - urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:article-24
      assessable: false
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:title-ii:4
      ref_id: Article 24
      description: Components of the ICT business continuity policy
      translations:
        fr:
          description: "Composantes de la politique de continuit\xE9 des activit\xE9\
            s de TIC"
    - urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:24.1
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:article-24
      ref_id: '24.1'
      description: 'Financial entities shall include in their ICT business continuity
        policy referred to in Article 11(1) of Regulation (EU) 2022/2554 all of the
        following:'
      translations:
        fr:
          description: "Les entit\xE9s financi\xE8res incluent dans leur politique\
            \ de continuit\xE9 des activit\xE9s de TIC vis\xE9e \xE0 l\u2019article\
            \ 11, paragraphe 1, du r\xE8glement (UE) 2022/2554 l\u2019ensemble des\
            \ \xE9l\xE9ments suivants:"
    - urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:24.1.a
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:24.1
      ref_id: 24.1.a
      description: 'a description of:'
      translations:
        fr:
          description: 'une description:'
    - urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:24.1.a.i
      assessable: true
      depth: 6
      parent_urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:24.1.a
      ref_id: 24.1.a.i
      description: the objectives of the ICT business continuity policy, including
        the interrelation of ICT and overall business continuity, and considering
        the results of the business impact analysis (BIA) referred to in Article 11(5)
        of Regulation (EU) 2022/2554;
      translations:
        fr:
          description: "des objectifs de la politique de continuit\xE9 des activit\xE9\
            s de TIC, notamment l\u2019interaction entre la continuit\xE9 des activit\xE9\
            s de TIC et la continuit\xE9 globale des activit\xE9s, en tenant compte\
            \ des r\xE9sultats de l\u2019analyse des incidences sur les activit\xE9\
            s vis\xE9e \xE0 l\u2019article 11, paragraphe 5, du r\xE8glement (UE)\
            \ 2022/2554;"
    - urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:24.1.a.ii
      assessable: true
      depth: 6
      parent_urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:24.1.a
      ref_id: 24.1.a.ii
      description: the scope of the ICT business continuity arrangements, plans, procedures,
        and mechanisms, including limitations and exclusions;
      translations:
        fr:
          description: "du champ d\u2019application des dispositifs, plans, proc\xE9\
            dures et m\xE9canismes de continuit\xE9 des activit\xE9s de TIC, y compris\
            \ des limitations et exclusions;"
    - urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:24.1.a.iii
      assessable: true
      depth: 6
      parent_urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:24.1.a
      ref_id: 24.1.a.iii
      description: the timeframe to be covered by the ICT business continuity arrangements,
        plans, procedures, and mechanisms;
      translations:
        fr:
          description: "de la p\xE9riode de temps \xE0 couvrir par les dispositifs,\
            \ plans, proc\xE9dures et m\xE9canismes de continuit\xE9 des activit\xE9\
            s de TIC;"
    - urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:24.1.a.iv
      assessable: true
      depth: 6
      parent_urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:24.1.a
      ref_id: 24.1.a.iv
      description: the criteria to activate and deactivate ICT business continuity
        plans, ICT response and recovery plans, and crisis communications plans;
      translations:
        fr:
          description: "des crit\xE8res d\u2019activation et de d\xE9sactivation des\
            \ plans de continuit\xE9 des activit\xE9s de TIC, des plans de r\xE9ponse\
            \ et de r\xE9tablissement des TIC, ainsi que des plans de communication\
            \ en situation de crise;"
    - urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:24.1.b
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:24.1
      ref_id: 24.1.b
      description: 'provisions on:'
      translations:
        fr:
          description: 'des dispositions concernant:'
    - urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:24.b.i
      assessable: true
      depth: 6
      parent_urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:24.1.b
      ref_id: 24.b.i
      description: the governance and organisation to implement the ICT business continuity
        policy, including roles, responsibilities and escalation procedures ensuring
        that sufficient resources are available;
      translations:
        fr:
          description: "la gouvernance et l\u2019organisation n\xE9cessaires \xE0\
            \ la mise en \u0153uvre de la politique de continuit\xE9 des activit\xE9\
            s de TIC, y compris les r\xF4les, les responsabilit\xE9s et les proc\xE9\
            dures de remont\xE9e des informations, en veillant \xE0 ce que des ressources\
            \ suffisantes soient disponibles;"
    - urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:24.b.ii
      assessable: true
      depth: 6
      parent_urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:24.1.b
      ref_id: 24.b.ii
      description: 'the alignment between the ICT business continuity plans and the
        overall business continuity plans, concerning at least all of the following:'
      translations:
        fr:
          description: "l\u2019alignement entre les plans de continuit\xE9 des activit\xE9\
            s de TIC et les plans globaux de continuit\xE9 des activit\xE9s, en ce\
            \ qui concerne au moins l\u2019ensemble des \xE9l\xE9ments suivants:"
    - urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:24.b.ii.1
      assessable: true
      depth: 7
      parent_urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:24.b.ii
      ref_id: 24.b.ii.1
      description: potential failure scenarios, including the scenarios referred to
        in Article 26(2) of this Regulation;
      translations:
        fr:
          description: "les sc\xE9narios de d\xE9faillance potentielle, notamment\
            \ les sc\xE9narios vis\xE9s \xE0 l\u2019article 26, paragraphe 2, du pr\xE9\
            sent r\xE8glement;"
    - urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:24.b.ii.2
      assessable: true
      depth: 7
      parent_urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:24.b.ii
      ref_id: 24.b.ii.2
      description: recovery objectives, specifying that the financial entity shall
        be able to recover the operations of its critical or important functions after
        disruptions within a recovery time objective and a recovery point objective;
      translations:
        fr:
          description: "les objectifs de r\xE9tablissement, en pr\xE9cisant que l\u2019\
            entit\xE9 financi\xE8re doit \xEAtre en mesure de r\xE9tablir les op\xE9\
            rations de ses fonctions critiques ou importantes apr\xE8s des perturbations\
            \ en respectant un objectif en mati\xE8re de d\xE9lai de r\xE9tablissement\
            \ et un objectif en mati\xE8re de point de r\xE9tablissement;"
    - urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:24.b.iii
      assessable: true
      depth: 6
      parent_urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:24.1.b
      ref_id: 24.b.iii
      description: the development of ICT business continuity plans for severe business
        disruptions as part of those plans, and the prioritisation of ICT business
        continuity actions using a risk-based approach;
      translations:
        fr:
          description: "l\u2019\xE9laboration de plans de continuit\xE9 des activit\xE9\
            s de TIC en cas de graves perturbations des activit\xE9s dans le cadre\
            \ de ces plans, et la hi\xE9rarchisation des mesures de continuit\xE9\
            \ des activit\xE9s de TIC selon une approche fond\xE9e sur les risques;"
    - urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:24.b.iv
      assessable: true
      depth: 6
      parent_urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:24.1.b
      ref_id: 24.b.iv
      description: the development, testing and review of ICT response and recovery
        plans, in accordance with Articles 25 and 26 of this Regulation;
      translations:
        fr:
          description: "l\u2019\xE9laboration, le test et l\u2019examen des plans\
            \ de r\xE9ponse et de r\xE9tablissement des TIC, conform\xE9ment aux articles\
            \ 25 et 26 du pr\xE9sent r\xE8glement;"
    - urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:24.b.v
      assessable: true
      depth: 6
      parent_urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:24.1.b
      ref_id: 24.b.v
      description: the review of the effectiveness of the implemented ICT business
        continuity arrangements, plans, procedures and mechanisms, in accordance with
        Article 26 of this Regulation;
      translations:
        fr:
          description: "l\u2019examen de l\u2019efficacit\xE9 des dispositifs, plans,\
            \ proc\xE9dures et m\xE9canismes de continuit\xE9 des activit\xE9s de\
            \ TIC mis en \u0153uvre, conform\xE9ment \xE0 l\u2019article 26 du pr\xE9\
            sent r\xE8glement;"
    - urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:24.b.vi
      assessable: true
      depth: 6
      parent_urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:24.1.b
      ref_id: 24.b.vi
      description: 'the alignment of the ICT business continuity policy to:'
      translations:
        fr:
          description: "l\u2019alignement de la politique de continuit\xE9 des activit\xE9\
            s de TIC sur:"
    - urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:24.b.vi.1
      assessable: true
      depth: 7
      parent_urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:24.b.vi
      ref_id: 24.b.vi.1
      description: the communication policy referred to in Article 14(2) of Regulation
        (EU) 2022/2554;
      translations:
        fr:
          description: "la politique de communication vis\xE9e \xE0 l\u2019article\
            \ 14, paragraphe 2, du r\xE8glement (UE) 2022/2554;"
    - urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:24.b.vi.2
      assessable: true
      depth: 7
      parent_urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:24.b.vi
      ref_id: 24.b.vi.2
      description: the communication and crisis communication actions referred to
        in Article 11(2), point (e), of Regulation (EU) 2022/2554.
      translations:
        fr:
          description: "les mesures de communication et de communication de crise\
            \ vis\xE9es \xE0 l\u2019article 11, paragraphe 2, point e), du r\xE8glement\
            \ (UE) 2022/2554."
    - urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:24.2
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:article-24
      ref_id: '24.2'
      description: 'In addition to the requirements referred to in paragraph 1, central
        counterparties shall ensure that their ICT business continuity policy:'
      translations:
        fr:
          description: "En plus de respecter les exigences pr\xE9vues au paragraphe\
            \ 1, les contreparties centrales veillent \xE0 ce que leur politique de\
            \ continuit\xE9 des activit\xE9s de TIC:"
    - urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:24.2.a
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:24.2
      ref_id: 24.2.a
      description: contains a maximum recovery time for their critical functions that
        is not longer than 2 hours;
      translations:
        fr:
          description: "pr\xE9voie, pour leurs fonctions critiques, un d\xE9lai de\
            \ r\xE9tablissement maximal ne d\xE9passant pas deux heures;"
    - urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:24.2.b
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:24.2
      ref_id: 24.2.b
      description: takes into account external links and interdependencies within
        the financial infrastructures, including trading venues cleared by the central
        counterparty, securities settlement and payment systems, and credit institutions
        used by the central counterparty or a linked central counterparty;
      translations:
        fr:
          description: "tienne compte des liens ext\xE9rieurs et des interd\xE9pendances\
            \ au sein des infrastructures financi\xE8res, y compris les plates-formes\
            \ de n\xE9gociation compens\xE9es par la contrepartie centrale, les syst\xE8\
            mes de r\xE8glement et de paiement des op\xE9rations sur titres, et les\
            \ \xE9tablissements de cr\xE9dit utilis\xE9s par la contrepartie centrale\
            \ ou par une contrepartie centrale \xE0 laquelle elle est li\xE9e;"
    - urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:24.2.c
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:24.2
      ref_id: 24.2.c
      description: 'requires that arrangements are in place to:'
      translations:
        fr:
          description: 'exige la mise en place de dispositifs pour:'
    - urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:24.2.c.i
      assessable: true
      depth: 6
      parent_urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:24.2.c
      ref_id: 24.2.c.i
      description: ensure the continuity of critical or important functions of the
        central counterparty based on disaster scenarios;
      translations:
        fr:
          description: "assurer la continuit\xE9 des fonctions critiques ou importantes\
            \ de la contrepartie centrale sur la base de sc\xE9narios de sinistres;"
    - urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:24.2.c.ii
      assessable: true
      depth: 6
      parent_urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:24.2.c
      ref_id: 24.2.c.ii
      description: maintain a secondary processing site capable of ensuring continuity
        of critical or important functions of the central counterparty identical to
        the primary site;
      translations:
        fr:
          description: "maintenir un site de traitement secondaire capable d\u2019\
            assurer la continuit\xE9 des fonctions critiques ou importantes de la\
            \ m\xEAme mani\xE8re que le site primaire;"
    - urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:24.2.c.iii
      assessable: true
      depth: 6
      parent_urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:24.2.c
      ref_id: 24.2.c.iii
      description: maintain or have immediate access to a secondary business site,
        to allow staff to ensure continuity of the service if the primary location
        of business is not available;
      translations:
        fr:
          description: "maintenir ou avoir un acc\xE8s imm\xE9diat \xE0 un site op\xE9\
            rationnel secondaire permettant au personnel d\u2019assurer la continuit\xE9\
            \ du service si le site op\xE9rationnel principal n\u2019est pas disponible;"
    - urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:24.2.c.iv
      assessable: true
      depth: 6
      parent_urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:24.2.c
      ref_id: 24.2.c.iv
      description: "consider the need for additional processing sites, in particular\
        \ where the diversity of the risk profiles of the primary and secondary sites\
        \ does not provide sufficient confidence that the central counterparty\u2019\
        s business continuity objectives will be met in all scenarios."
      translations:
        fr:
          description: "\xE9valuer la n\xE9cessit\xE9 de mettre en place des sites\
            \ de traitement suppl\xE9mentaires, en particulier lorsque la diversit\xE9\
            \ des profils de risque des sites primaire et secondaire ne permet pas\
            \ de garantir avec suffisamment de certitude que les objectifs de continuit\xE9\
            \ des activit\xE9s de la contrepartie centrale seront atteints dans tous\
            \ les cas de figure."
    - urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:article-24:1
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:article-24
      description: For the purposes of point (a), central counterparties shall complete
        end of day procedures and payments on the required time and day in all circumstances.
      translations:
        fr:
          description: "Aux fins du point a), les contreparties centrales finalisent\
            \ les proc\xE9dures et les paiements de fin de journ\xE9e \xE0 l\u2019\
            heure et \xE0 la date requises, et cela en toutes circonstances."
    - urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:article-24:2
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:article-24
      description: For the purposes of point (c)(i), arrangements referred to in that
        point shall address the availability of adequate human resources, the maximum
        downtime of critical functions, and fail over and recovery to a secondary
        site.
      translations:
        fr:
          description: "Aux fins du point c) i), les dispositifs vis\xE9s audit point\
            \ garantissent la disponibilit\xE9 de ressources humaines ad\xE9quates,\
            \ une dur\xE9e maximale d\u2019indisponibilit\xE9 des fonctions critiques\
            \ ainsi qu\u2019un transfert automatique et une reprise des activit\xE9\
            s sur un site secondaire."
    - urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:article-24:3
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:article-24
      description: For the purposes of point (c)(ii), the secondary processing site
        referred to in that point shall have a geographical risk profile which is
        distinct from that of the primary site.
      translations:
        fr:
          description: "Aux fins du point c) ii), le site secondaire de traitement\
            \ vis\xE9 audit point pr\xE9sente un profil de risque g\xE9ographique\
            \ distinct de celui du site primaire."
    - urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:24.3
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:article-24
      ref_id: '24.3'
      description: 'In addition to the requirements referred to in paragraph 1, central
        securities depositories shall ensure that their ICT business continuity policy:'
      translations:
        fr:
          description: "En plus de respecter les exigences pr\xE9vues au paragraphe\
            \ 1, les d\xE9positaires centraux de titres veillent \xE0 ce que leur\
            \ politique de continuit\xE9 des activit\xE9s de TIC:"
    - urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:24.3.a
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:24.3
      ref_id: 24.3.a
      description: takes into account any links and interdependencies to users, critical
        utilities and critical service providers, other central securities depositories
        and other market infrastructures;
      translations:
        fr:
          description: "tienne compte des liens et interd\xE9pendances avec les utilisateurs,\
            \ les prestataires de services et fournisseurs de services de r\xE9seau\
            \ essentiels, les autres d\xE9positaires centraux de titres et les autres\
            \ infrastructures de march\xE9;"
    - urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:24.3.b
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:24.3
      ref_id: 24.3.b
      description: requires its ICT business continuity arrangements to ensure that
        the recovery time objective for their critical or important functions shall
        not be longer than 2 hours.
      translations:
        fr:
          description: "exige que ses dispositifs de continuit\xE9 des activit\xE9\
            s de TIC garantissent que l\u2019objectif en mati\xE8re de d\xE9lai de\
            \ r\xE9tablissement des fonctions critiques ou importantes ne d\xE9passe\
            \ pas deux heures."
    - urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:24.4
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:article-24
      ref_id: '24.4'
      description: 'In addition to the requirements referred to in paragraph 1, trading
        venues shall ensure that their ICT business continuity policy ensures that:'
      translations:
        fr:
          description: "En plus de respecter les exigences pr\xE9vues au paragraphe\
            \ 1, les plates-formes de n\xE9gociation veillent \xE0 ce que leur politique\
            \ de continuit\xE9 des activit\xE9s de TIC garantisse:"
    - urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:24.4.a
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:24.4
      ref_id: 24.4.a
      description: trading can be resumed within or close to 2 hours of a disruptive
        incident;
      translations:
        fr:
          description: "qu\u2019apr\xE8s un incident perturbateur, la n\xE9gociation\
            \ peut reprendre dans les deux heures, ou dans un d\xE9lai proche de deux\
            \ heures;"
    - urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:24.4.b
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:24.4
      ref_id: 24.4.b
      description: the maximum amount of data that may be lost from any IT service
        of the trading venue after a disruptive incident is close to zero.
      translations:
        fr:
          description: "que la quantit\xE9 maximale de donn\xE9es susceptibles d\u2019\
            \xEAtre perdues par un service informatique de la plate-forme de n\xE9\
            gociation apr\xE8s un incident perturbateur est proche de z\xE9ro."
    - urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:article-25
      assessable: false
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:title-ii:4
      ref_id: Article 25
      description: Testing of the ICT business continuity plans
      translations:
        fr:
          description: "Tests des plans de continuit\xE9 des activit\xE9s de TIC"
    - urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:25.1
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:article-25
      ref_id: '25.1'
      description: "When testing the ICT business continuity plans in accordance with\
        \ Article 11(6), of Regulation (EU) 2022/2554, financial entities shall take\
        \ into account the financial entity\u2019s business impact analysis (BIA)\
        \ and the ICT risk assessment referred to in Article 3(1), point (b), of this\
        \ Regulation."
      translations:
        fr:
          description: "Lorsqu\u2019elles testent les plans de continuit\xE9 des activit\xE9\
            s de TIC conform\xE9ment \xE0 l\u2019article 11, paragraphe 6, du r\xE8\
            glement (UE) 2022/2554, les entit\xE9s financi\xE8res tiennent compte\
            \ de l\u2019analyse des incidences sur les activit\xE9s de l\u2019entit\xE9\
            \ financi\xE8re et de l\u2019\xE9valuation du risque li\xE9 aux TIC vis\xE9\
            e \xE0 l\u2019article 3, premier alin\xE9a, point b), du pr\xE9sent r\xE8\
            glement."
    - urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:25.2
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:article-25
      ref_id: '25.2'
      description: "Financial entities shall assess through the testing of their ICT\
        \ business continuity plans referred to in paragraph 1 whether they are able\
        \ to ensure the continuity of the financial entity\u2019s critical or important\
        \ functions. That testing shall:"
      translations:
        fr:
          description: "Les entit\xE9s financi\xE8res \xE9valuent, au moyen des tests\
            \ de leurs plans de continuit\xE9 des activit\xE9s de TIC vis\xE9s au\
            \ paragraphe 1, si elles sont en mesure d\u2019assurer la continuit\xE9\
            \ de leurs fonctions critiques ou importantes. Ces tests:"
    - urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:25.2.a
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:25.2
      ref_id: 25.2.a
      description: 'be performed on the basis of test scenarios that simulate potential
        disruptions,

        including an adequate set of severe but plausible scenarios;'
      translations:
        fr:
          description: "sont r\xE9alis\xE9s sur la base de sc\xE9narios de test simulant\
            \ des perturbations potentielles, y compris un ensemble ad\xE9quat de\
            \ sc\xE9narios graves mais plausibles;"
    - urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:25.2.b
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:25.2
      ref_id: 25.2.b
      description: contain the testing of ICT services provided by ICT third-party
        service providers, where applicable;
      translations:
        fr:
          description: "comprennent, le cas \xE9ch\xE9ant, des tests des services\
            \ TIC fournis par des prestataires tiers de services TIC;"
    - urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:25.2.c
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:25.2
      ref_id: 25.2.c
      description: for financial entities, other than microenterprises, as referred
        to in Article 11(6), second subparagraph, of Regulation (EU) 2022/2554, contain
        scenarios of switchover from primary ICT infrastructure to the redundant capacity,
        backups and redundant facilities;
      translations:
        fr:
          description: "pour les entit\xE9s financi\xE8res, autres que les microentreprises,\
            \ vis\xE9es \xE0 l\u2019article 11, paragraphe 6, deuxi\xE8me alin\xE9\
            a, du r\xE8glement (UE) 2022/2554, comprennent des sc\xE9narios de basculement\
            \ entre l\u2019infrastructure de TIC principale et la capacit\xE9 redondante,\
            \ les sauvegardes et les installations redondantes;"
    - urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:25.2.d
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:25.2
      ref_id: 25.2.d
      description: be designed to challenge the assumptions on which the business
        continuity plans are based, including governance arrangements and crisis communication
        plans;
      translations:
        fr:
          description: "sont con\xE7us pour \xE9prouver les hypoth\xE8ses sur lesquelles\
            \ se fondent les plans de continuit\xE9 des activit\xE9s, y compris les\
            \ dispositifs de gouvernance et les plans de communication en situation\
            \ de crise;"
    - urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:25.2.e
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:25.2
      ref_id: 25.2.e
      description: "contain procedures to verify the ability of the financial entities\u2019\
        \ staff, of ICT third-party service providers, of ICT systems, and ICT services\
        \ to respond adequately to the scenarios duly taken into account in accordance\
        \ with Article 26(2)."
      translations:
        fr:
          description: "comportent des proc\xE9dures visant \xE0 v\xE9rifier la capacit\xE9\
            \ du personnel des entit\xE9s financi\xE8res, des prestataires tiers de\
            \ services TIC, des syst\xE8mes de TIC et des services TIC \xE0 r\xE9\
            pondre de mani\xE8re ad\xE9quate aux sc\xE9narios d\xFBment pris en consid\xE9\
            ration conform\xE9ment \xE0 l\u2019article 26, paragraphe 2."
    - urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:article-25:1
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:article-25
      description: For the purposes of point (a), financial entities shall always
        include in the testing the scenarios considered for the development of the
        business continuity plans.
      translations:
        fr:
          description: "Aux fins du point a), les entit\xE9s financi\xE8res incluent\
            \ toujours dans les tests les sc\xE9narios envisag\xE9s pour l\u2019\xE9\
            laboration des plans de continuit\xE9 des activit\xE9s."
    - urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:article-25:2
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:article-25
      description: "For the purposes of point (b), financial entities shall duly consider\
        \ scenarios linked to insolvency or failures of the ICT third-party service\
        \ providers or linked to political risks in the ICT third-party service providers\u2019\
        \ jurisdictions, where relevant."
      translations:
        fr:
          description: "Aux fins du point b), les entit\xE9s financi\xE8res tiennent\
            \ d\xFBment compte des sc\xE9narios li\xE9s \xE0 l\u2019insolvabilit\xE9\
            \ ou aux d\xE9faillances des prestataires tiers de services TIC ou aux\
            \ risques politiques dans les juridictions des prestataires tiers de services\
            \ TIC, le cas \xE9ch\xE9ant."
    - urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:article-25:3
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:article-25
      description: 'For the purposes of point (c), the testing shall verify whether
        at least critical or

        important functions can be operated appropriately for a sufficient period
        of time, and

        whether the normal functioning may be restored.'
      translations:
        fr:
          description: "Aux fins du point c), les tests permettent de v\xE9rifier\
            \ si au moins les fonctions critiques ou importantes peuvent \xEAtre exerc\xE9\
            es de mani\xE8re appropri\xE9e pendant une dur\xE9e suffisante et si le\
            \ fonctionnement normal peut \xEAtre r\xE9tabli."
    - urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:25.3
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:article-25
      ref_id: '25.3'
      description: 'In addition to the requirements referred to in paragraph 2, central
        counterparties shall involve in the testing of their ICT business continuity
        plans referred to in paragraph 1:'
      translations:
        fr:
          description: "En plus de respecter les exigences pr\xE9vues au paragraphe\
            \ 2, les contreparties centrales associent aux tests de leurs plans de\
            \ continuit\xE9 des activit\xE9s de TIC vis\xE9s au paragraphe 1:"
    - urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:25.3.a
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:25.3
      ref_id: 25.3.a
      description: clearing members;
      translations:
        fr:
          description: les membres compensateurs;
    - urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:25.3.b
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:25.3
      ref_id: 25.3.b
      description: external providers;
      translations:
        fr:
          description: les prestataires externes;
    - urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:25.3.c
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:25.3
      ref_id: 25.3.c
      description: relevant institutions in the financial infrastructure with which
        central counterparties have identified interdependencies in their business
        continuity policies.
      translations:
        fr:
          description: "les \xE9tablissements de l\u2019infrastructure financi\xE8\
            re avec lesquels les contreparties centrales ont constat\xE9 des interd\xE9\
            pendances dans le cadre de leur politique de continuit\xE9 des activit\xE9\
            s."
    - urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:25.4
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:article-25
      ref_id: '25.4'
      description: 'In addition to the requirements referred to in paragraph 2, central
        securities depositories shall involve in the testing of their ICT business
        continuity plans referred to in paragraph 1, as appropriate:'
      translations:
        fr:
          description: "En plus de respecter les exigences pr\xE9vues au paragraphe\
            \ 2, les d\xE9positaires centraux de titres associent, le cas \xE9ch\xE9\
            ant, aux tests de leurs plans de continuit\xE9 des activit\xE9s de TIC\
            \ vis\xE9s au paragraphe 1:"
    - urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:25.4.a
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:25.4
      ref_id: 25.4.a
      description: users of the central securities depositories;
      translations:
        fr:
          description: "les utilisateurs des d\xE9positaires centraux de titres;"
    - urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:25.4.b
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:25.4
      ref_id: 25.4.b
      description: critical utilities and critical service providers;
      translations:
        fr:
          description: "les prestataires de services et fournisseurs de services de\
            \ r\xE9seau essentiels;"
    - urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:25.4.c
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:25.4
      ref_id: 25.4.c
      description: other central securities depositories;
      translations:
        fr:
          description: "d\u2019autres d\xE9positaires centraux de titres;"
    - urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:25.4.d
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:25.4
      ref_id: 25.4.d
      description: other market infrastructures;
      translations:
        fr:
          description: "d\u2019autres infrastructures de march\xE9;"
    - urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:25.4.e
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:25.4
      ref_id: 25.4.e
      description: any other institutions with which central securities depositories
        have identified interdependencies in their business continuity policy.
      translations:
        fr:
          description: "d\u2019autres \xE9tablissements avec lesquels les d\xE9positaires\
            \ centraux de titres ont constat\xE9 des interd\xE9pendances dans le cadre\
            \ de leur politique de continuit\xE9 des activit\xE9s."
    - urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:25.5
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:article-25
      ref_id: '25.5'
      description: Financial entities shall document the results of the testing referred
        to in paragraph 1. Any identified deficiencies resulting from that testing
        shall be analysed, addressed,and reported to the management body.
      translations:
        fr:
          description: "Les entit\xE9s financi\xE8res documentent les r\xE9sultats\
            \ des tests vis\xE9s au paragraphe 1. Toute d\xE9faillance constat\xE9\
            e \xE0 la suite de ces tests est analys\xE9e, trait\xE9e et notifi\xE9\
            e \xE0 l\u2019organe de direction."
    - urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:article-26
      assessable: false
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:title-ii:4
      ref_id: Article 26
      description: ICT response and recovery plans
      translations:
        fr:
          description: "Plans de r\xE9ponse et de r\xE9tablissement des TIC"
    - urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:26.1
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:article-26
      ref_id: '26.1'
      description: "When developing the ICT response and recovery plans referred to\
        \ in Article 11(3) of Regulation (EU) 2022/2554, financial entities shall\
        \ take into account the results of the financial entity\u2019s business impact\
        \ analysis (BIA). Those ICT response and recovery plans shall:"
      translations:
        fr:
          description: "Lorsqu\u2019elles \xE9laborent les plans de r\xE9ponse et\
            \ de r\xE9tablissement des TIC vis\xE9s \xE0 l\u2019article 11, paragraphe\
            \ 3, du r\xE8glement (UE) 2022/2554, les entit\xE9s financi\xE8res tiennent\
            \ compte des r\xE9sultats de l\u2019analyse des incidences sur les activit\xE9\
            s de l\u2019entit\xE9 financi\xE8re. Ces plans de r\xE9ponse et de r\xE9\
            tablissement des TIC:"
    - urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:26.1.a
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:26.1
      ref_id: 26.1.a
      description: 'specify the conditions prompting their activation or deactivation,
        and any

        exceptions for such activation or deactivation;'
      translations:
        fr:
          description: "d\xE9finissent les conditions qui d\xE9clenchent leur activation\
            \ ou d\xE9sactivation, ainsi que toute exception \xE0 cette activation\
            \ ou d\xE9sactivation;"
    - urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:26.1.b
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:26.1
      ref_id: 26.1.b
      description: describe what actions are to be taken to ensure the availability,
        integrity, continuity, and recovery of at least ICT systems and services supporting
        critical or important functions of the financial entity;
      translations:
        fr:
          description: "d\xE9crivent les mesures \xE0 prendre pour garantir la disponibilit\xE9\
            , l\u2019int\xE9grit\xE9, la continuit\xE9 et le r\xE9tablissement au\
            \ moins des syst\xE8mes et services TIC qui soutiennent des fonctions\
            \ critiques ou importantes de l\u2019entit\xE9 financi\xE8re;"
    - urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:26.1.c
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:26.1
      ref_id: 26.1.c
      description: 'be designed to meet the recovery objectives of the operations
        of the financial

        entities;'
      translations:
        fr:
          description: "sont con\xE7us pour atteindre les objectifs de r\xE9tablissement\
            \ des op\xE9rations des entit\xE9s financi\xE8res;"
    - urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:26.1.d
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:26.1
      ref_id: 26.1.d
      description: be documented and made available to the staff involved in the execution
        of ICT response and recovery plans and be readily accessible in case of emergency;
      translations:
        fr:
          description: "sont document\xE9s et mis \xE0 la disposition du personnel\
            \ participant \xE0 l\u2019ex\xE9cution des plans de r\xE9ponse et de r\xE9\
            tablissement des TIC et sont facilement accessibles en cas d\u2019urgence;"
    - urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:26.1.e
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:26.1
      ref_id: 26.1.e
      description: provide for both short-term and long-term recovery options, including
        partial systems recovery;
      translations:
        fr:
          description: "pr\xE9voient des options de r\xE9tablissement \xE0 court et\
            \ \xE0 long terme, y compris de r\xE9tablissement partiel des syst\xE8\
            mes;"
    - urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:26.1.f
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:26.1
      ref_id: 26.1.f
      description: lay down the objectives of ICT response and recovery plans and
        the conditions to declare a successful execution of those plans.
      translations:
        fr:
          description: "d\xE9finissent les objectifs des plans de r\xE9ponse et de\
            \ r\xE9tablissement des TIC et les conditions permettant de d\xE9clarer\
            \ que ces plans ont \xE9t\xE9 ex\xE9cut\xE9s avec succ\xE8s."
    - urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:article-26:1
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:article-26
      description: For the purposes of point (d), financial entities shall clearly
        specify roles and responsibilities.
      translations:
        fr:
          description: "Aux fins du point d), les entit\xE9s financi\xE8res pr\xE9\
            cisent clairement les r\xF4les et responsabilit\xE9s."
    - urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:26.2
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:article-26
      ref_id: '26.2'
      description: 'The ICT response and recovery plans referred to in paragraph 1
        shall identify relevant scenarios, including scenarios of severe business
        disruptions and increased likelihood of occurrence of disruption. Those plans
        shall develop scenarios based on current information on threats and on lessons
        learned from previous occurrences of business disruptions. Financial entities
        shall duly take into account all of the following scenarios:'
      translations:
        fr:
          description: "Les plans de r\xE9ponse et de r\xE9tablissement des TIC vis\xE9\
            s au paragraphe 1 recensent les sc\xE9narios pertinents, y compris les\
            \ sc\xE9narios de graves perturbations des activit\xE9s et de probabilit\xE9\
            \ accrue de survenance d\u2019une perturbation. Ces plans \xE9tablissent\
            \ des sc\xE9narios fond\xE9s sur les informations actuelles sur les menaces\
            \ et sur les enseignements tir\xE9s des perturbations des activit\xE9\
            s survenues ant\xE9rieurement. Les entit\xE9s financi\xE8res tiennent\
            \ d\xFBment compte de tous les sc\xE9narios suivants:"
    - urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:26.2.a
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:26.2
      ref_id: 26.2.a
      description: cyber-attacks and switchovers between the primary ICT infrastructure
        and the redundant capacity, backups, and redundant facilities;
      translations:
        fr:
          description: "des cyberattaques et des basculements entre l\u2019infrastructure\
            \ de TIC principale et la capacit\xE9 redondante, les sauvegardes et les\
            \ installations redondantes;"
    - urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:26.2.b
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:26.2
      ref_id: 26.2.b
      description: scenarios in which the quality of the provision of a critical or
        important function deteriorates to an unacceptable level or fails, and duly
        consider the potential impact of the insolvency, or other failures, of any
        relevant ICT third- party service provider;
      translations:
        fr:
          description: "les sc\xE9narios dans lesquels la qualit\xE9 de l\u2019ex\xE9\
            cution d\u2019une fonction critique ou importante se d\xE9t\xE9riore \xE0\
            \ un niveau inacceptable, en prenant alors d\xFBment en consid\xE9ration\
            \ les incidences potentielles de l\u2019insolvabilit\xE9 ou d\u2019autres\
            \ d\xE9faillances de tout prestataire tiers de services TIC concern\xE9\
            ;"
    - urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:26.2.c
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:26.2
      ref_id: 26.2.c
      description: partial or total failure of premises, including office and business
        premises, and data centres;
      translations:
        fr:
          description: "la d\xE9faillance partielle ou totale des locaux, notamment\
            \ des locaux de bureau et des locaux commerciaux, et des centres de donn\xE9\
            es;"
    - urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:26.2.d
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:26.2
      ref_id: 26.2.d
      description: substantial failure of ICT assets or of the communication infrastructure;
      translations:
        fr:
          description: "une d\xE9faillance substantielle des actifs de TIC ou de l\u2019\
            infrastructure de communication;"
    - urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:26.2.e
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:26.2
      ref_id: 26.2.e
      description: the non-availability of a critical number of staff or staff members
        in charge of guaranteeing the continuity of operations;
      translations:
        fr:
          description: "l\u2019indisponibilit\xE9 d\u2019un nombre critique de membres\
            \ du personnel ou de personnes charg\xE9es de garantir la continuit\xE9\
            \ des op\xE9rations;"
    - urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:26.2.f
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:26.2
      ref_id: 26.2.f
      description: impact of climate change and environment degradation related events,
        natural disasters, pandemics, and physical attacks, including intrusions and
        terrorist attacks;
      translations:
        fr:
          description: "les incidences des \xE9v\xE9nements li\xE9s au changement\
            \ climatique et \xE0 la d\xE9gradation de l\u2019environnement, des catastrophes\
            \ naturelles, des pand\xE9mies et des attaques physiques, y compris des\
            \ intrusions et des attentats terroristes;"
    - urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:26.2.g
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:26.2
      ref_id: 26.2.g
      description: insider attacks;
      translations:
        fr:
          description: les attaques internes;
    - urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:26.2.h
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:26.2
      ref_id: 26.2.h
      description: "political and social instability, including, where relevant, in\
        \ the ICT third-party service provider\u2019s jurisdiction and the location\
        \ where the data are stored and processed;"
      translations:
        fr:
          description: "l\u2019instabilit\xE9 politique et sociale, y compris, le\
            \ cas \xE9ch\xE9ant, dans la juridiction du prestataire tiers de services\
            \ TIC et \xE0 l\u2019endroit o\xF9 les donn\xE9es sont stock\xE9es et\
            \ trait\xE9es;"
    - urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:26.2.i
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:26.2
      ref_id: 26.2.i
      description: widespread power outages
      translations:
        fr:
          description: "les coupures de courant \xE0 une grande \xE9chelle."
    - urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:26.3
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:article-26
      ref_id: '26.3'
      description: Where the primary recovery measures may not be feasible in the
        short term because of costs, risks, logistics, or unforeseen circumstances,
        the ICT response and recovery plans referred to in paragraph 1 shall consider
        alternative options.
      translations:
        fr:
          description: "Lorsque les mesures de r\xE9tablissement primaires sont susceptibles\
            \ de ne pas \xEAtre r\xE9alisables \xE0 court terme en raison des co\xFB\
            ts, des risques, de probl\xE8mes logistiques ou de circonstances impr\xE9\
            vues, les plans de r\xE9ponse et de r\xE9tablissement des TIC vis\xE9\
            s au paragraphe 1 envisagent d\u2019autres options."
    - urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:26.4
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:article-26
      ref_id: '26.4'
      description: As part of the ICT response and recovery plans referred to in paragraph
        1, financial entities shall consider and implement continuity measures to
        mitigate failures of ICT third-party service providers of ICT services supporting
        critical or important functions of the financial entity.
      translations:
        fr:
          description: "Dans le cadre des plans de r\xE9ponse et de r\xE9tablissement\
            \ des TIC vis\xE9s au paragraphe 1, les entit\xE9s financi\xE8res \xE9\
            tudient et mettent en \u0153uvre des mesures de continuit\xE9 pour att\xE9\
            nuer les cons\xE9quences des d\xE9faillances des prestataires tiers de\
            \ services TIC qui fournissent des services TIC \xE0 l\u2019appui de fonctions\
            \ critiques ou importantes de l\u2019entit\xE9 financi\xE8re."
    - urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:title-ii:5
      assessable: false
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:title-ii
      name: CHAPTER V
      description: REPORT ON THE ICT RISK MANAGEMENT FRAMEWORK REVIEW
      translations:
        fr:
          name: CHAPITRE V
          description: "Rapport sur le r\xE9examen du cadre de gestion du risque li\xE9\
            \ aux TIC"
    - urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:article-27
      assessable: false
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:title-ii:5
      ref_id: Article 27
      description: Format and content of the report on the review of the ICT risk
        management framework
      translations:
        fr:
          description: "Format et contenu du rapport sur le r\xE9examen du cadre de\
            \ gestion du risque li\xE9 aux TIC"
    - urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:27.1
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:article-27
      ref_id: '27.1'
      description: Financial entities shall submit the report on the review of the
        ICT risk management framework referred to in Article 6(5) of Regulation (EU)
        2022/2554 in a searchable electronic format.
      translations:
        fr:
          description: "Les entit\xE9s financi\xE8res pr\xE9sentent le rapport sur\
            \ le r\xE9examen du cadre de gestion du risque li\xE9 aux TIC vis\xE9\
            \ \xE0 l\u2019article 6, paragraphe 5, du r\xE8glement (UE) 2022/2554\
            \ dans un format \xE9lectronique interrogeable."
    - urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:27.2
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:article-27
      ref_id: '27.2'
      description: 'Financial entities shall include all of the following information
        in the report referred to in paragraph 1:'
      translations:
        fr:
          description: "Les entit\xE9s financi\xE8res incluent l\u2019ensemble des\
            \ informations suivantes dans le rapport vis\xE9 au paragraphe 1:"
    - urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:27.2.a
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:27.2
      ref_id: 27.2.a
      description: 'an introductory section that:'
      translations:
        fr:
          description: 'une partie introductive qui:'
    - urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:27.2.a.i
      assessable: true
      depth: 6
      parent_urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:27.2.a
      ref_id: 27.2.a.i
      description: clearly identifies the financial entity that is the subject of
        the report, and describes its group structure, where relevant;
      translations:
        fr:
          description: "identifie clairement l\u2019entit\xE9 financi\xE8re faisant\
            \ l\u2019objet du rapport et d\xE9crit sa structure de groupe, le cas\
            \ \xE9ch\xE9ant;"
    - urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:27.2.a.ii
      assessable: true
      depth: 6
      parent_urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:27.2.a
      ref_id: 27.2.a.ii
      description: describes the context of the report in terms of the nature, scale,
        and complexity of the financial entity's services, activities, and operations,
        its organisation, identified critical functions, strategy, major ongoing projects
        or activities, relationships and its dependence on in-house and contracted
        ICT services and systems or the implications that a total loss or severe degradation
        of such systems would have in terms of critical or important functions and
        market efficiency;
      translations:
        fr:
          description: "d\xE9crit le contexte du rapport en ce qui concerne la nature,\
            \ l\u2019\xE9chelle et la complexit\xE9 des services, activit\xE9s et\
            \ op\xE9rations de l\u2019entit\xE9 financi\xE8re, son organisation, ses\
            \ fonctions critiques recens\xE9es, sa strat\xE9gie, ses grands projets\
            \ ou activit\xE9s en cours, ses relations et sa d\xE9pendance \xE0 l\u2019\
            \xE9gard de services et syst\xE8mes de TIC internes ou sous-trait\xE9\
            s, ou les cons\xE9quences qu\u2019une perte totale ou une d\xE9gradation\
            \ grave de ces syst\xE8mes engendrerait en ce qui concerne les fonctions\
            \ critiques ou importantes et l\u2019efficience du march\xE9;"
    - urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:27.2.a.iii
      assessable: true
      depth: 6
      parent_urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:27.2.a
      ref_id: 27.2.a.iii
      description: summarises the major changes in the ICT risk management framework
        since the previous report submitted;
      translations:
        fr:
          description: "r\xE9sume les changements majeurs dont le cadre de gestion\
            \ du risque li\xE9 aux TIC a fait l\u2019objet depuis le rapport pr\xE9\
            c\xE9dent;"
    - urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:27.2.a.iv
      assessable: true
      depth: 6
      parent_urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:27.2.a
      ref_id: 27.2.a.iv
      description: provides an executive level summary of the current and near-term
        ICT risk profile, threat landscape, the assessed effectiveness of its controls,
        and the security posture of the financial entity;
      translations:
        fr:
          description: "pr\xE9sente une synth\xE8se du profil de risque li\xE9 aux\
            \ TIC actuel et \xE0 court terme, due l\u2019\xE9ventail des menaces,\
            \ de l\u2019\xE9valuation de l\u2019efficacit\xE9 de ses contr\xF4les\
            \ et de la posture de s\xE9curit\xE9 de l\u2019entit\xE9 financi\xE8re;"
    - urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:27.2.b
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:27.2
      ref_id: 27.2.b
      description: the date of the approval of the report by the management body of
        the financial entity;
      translations:
        fr:
          description: "la date d\u2019approbation du rapport par l\u2019organe de\
            \ direction de l\u2019entit\xE9 financi\xE8re;"
    - urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:27.2.c
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:27.2
      ref_id: 27.2.c
      description: a description of the reason for the review of the ICT risk management
        framework in accordance with Article 6(5) of Regulation (EU) 2022/2554.;
      translations:
        fr:
          description: "une description de la raison du r\xE9examen du cadre de gestion\
            \ du risque li\xE9 aux TIC engag\xE9 conform\xE9ment \xE0 l\u2019article\
            \ 6, paragraphe 5, du r\xE8glement (UE) 2022/2554;"
    - urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:27.2.d
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:27.2
      ref_id: 27.2.d
      description: the start and end dates of the review period;
      translations:
        fr:
          description: "les dates de d\xE9but et de fin de la p\xE9riode examin\xE9\
            e;"
    - urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:27.2.e
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:27.2
      ref_id: 27.2.e
      description: an indication of the function responsible for the review;
      translations:
        fr:
          description: "l\u2019indication de la fonction responsable du r\xE9examen;"
    - urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:27.2.f
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:27.2
      ref_id: 27.2.f
      description: a description of the major changes and improvements to the ICT
        risk management framework since the previous review;
      translations:
        fr:
          description: "une description des principales modifications et am\xE9liorations\
            \ dont le cadre de gestion du risque li\xE9 aux TIC a fait l\u2019objet\
            \ depuis le r\xE9examen pr\xE9c\xE9dent;"
    - urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:27.2.g
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:27.2
      ref_id: 27.2.g
      description: a summary of the findings of the review and detailed analysis and
        assessment of the severity of the weaknesses, deficiencies, and gaps in the
        ICT risk management framework during the review period;
      translations:
        fr:
          description: "un r\xE9sum\xE9 des conclusions du r\xE9examen ainsi qu\u2019\
            une analyse et une \xE9valuation d\xE9taill\xE9es de la gravit\xE9 des\
            \ faiblesses, des d\xE9faillances et des lacunes du cadre de gestion du\
            \ risque li\xE9 aux TIC au cours de la p\xE9riode examin\xE9e;"
    - urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:27.2.h
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:27.2
      ref_id: 27.2.h
      description: 'a description of the measures to address identified weaknesses,
        deficiencies, and gaps, including all of the following:'
      translations:
        fr:
          description: "une description des mesures prises face aux faiblesses, d\xE9\
            faillances et lacunes constat\xE9es, comprenant l\u2019ensemble des \xE9\
            l\xE9ments suivants:"
    - urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:27.2.h.i
      assessable: true
      depth: 6
      parent_urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:27.2.h
      ref_id: 27.2.h.i
      description: a summary of measures taken to remediate to identified weaknesses,
        deficiencies and gaps;
      translations:
        fr:
          description: "un r\xE9sum\xE9 des mesures prises pour rem\xE9dier aux faiblesses,\
            \ d\xE9faillances et lacunes constat\xE9es;"
    - urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:27.2.h.ii
      assessable: true
      depth: 6
      parent_urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:27.2.h
      ref_id: 27.2.h.ii
      description: an expected date for implementing the measures and dates related
        to the internal control of the implementation, including information on the
        state of progress of the implementation of those measures as at the date of
        drafting of the report, explaining, where applicable, if there is a risk that
        deadlines may not be respected;
      translations:
        fr:
          description: "une date pr\xE9vue pour la mise en \u0153uvre des mesures\
            \ et des dates relatives au contr\xF4le interne de la mise en \u0153uvre,\
            \ y compris des informations sur l\u2019\xE9tat d\u2019avancement de la\
            \ mise en \u0153uvre de ces mesures \xE0 la date de r\xE9daction du rapport,\
            \ en expliquant, le cas \xE9ch\xE9ant, s\u2019il existe un risque que\
            \ les d\xE9lais ne soient pas respect\xE9s;"
    - urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:27.2.h.iii
      assessable: true
      depth: 6
      parent_urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:27.2.h
      ref_id: 27.2.h.iii
      description: tools to be used, and the identification of the function responsible
        for carrying out the measures, detailing whether the tools and functions are
        internal or external;
      translations:
        fr:
          description: "les outils \xE0 utiliser et l\u2019identification de la fonction\
            \ responsable de l\u2019ex\xE9cution des mesures, en pr\xE9cisant si les\
            \ outils et les fonctions sont internes ou externes;"
    - urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:27.2.h.iv
      assessable: true
      depth: 6
      parent_urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:27.2.h
      ref_id: 27.2.h.iv
      description: a description of the impact of the changes envisaged in the measures
        on the financial entity's budgetary, human, and material resources, including
        resources dedicated to the implementation of any corrective measures;
      translations:
        fr:
          description: "une description de l\u2019incidence des modifications envisag\xE9\
            es dans les mesures sur les ressources budg\xE9taires, humaines et mat\xE9\
            rielles de l\u2019entit\xE9 financi\xE8re, y compris sur les ressources\
            \ consacr\xE9es \xE0 la mise en \u0153uvre de toute mesure corrective;"
    - urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:27.2.h.v
      assessable: true
      depth: 6
      parent_urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:27.2.h
      ref_id: 27.2.h.v
      description: information on the process for informing the competent authority,
        where appropriate;
      translations:
        fr:
          description: "des informations sur le processus d\u2019information de l\u2019\
            autorit\xE9 comp\xE9tente, le cas \xE9ch\xE9ant;"
    - urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:27.2.h.vi
      assessable: true
      depth: 6
      parent_urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:27.2.h
      ref_id: 27.2.h.vi
      description: where the weaknesses, deficiencies, or gaps identified are not
        subject to corrective measures, a detailed explanation of the criteria used
        to analyse the impact of those weaknesses, deficiencies, or gaps, to evaluate
        the related residual ICT risk, and of the criteria used to accept the related
        residual risk;
      translations:
        fr:
          description: "lorsque les faiblesses, d\xE9faillances ou lacunes recens\xE9\
            es ne font pas l\u2019objet de mesures correctives, une explication d\xE9\
            taill\xE9e des crit\xE8res appliqu\xE9s pour analyser leur incidence et\
            \ \xE9valuer le risque r\xE9siduel li\xE9 aux TIC qui leur est associ\xE9\
            , ainsi que des crit\xE8res appliqu\xE9s pour accepter ce risque r\xE9\
            siduel;"
    - urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:27.2.i
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:27.2
      ref_id: 27.2.i
      description: information on planned further developments of the ICT risk management
        framework;
      translations:
        fr:
          description: "des informations sur les nouvelles \xE9volutions pr\xE9vues\
            \ du cadre de gestion du risque li\xE9 aux TIC;"
    - urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:27.2.j
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:27.2
      ref_id: 27.2.j
      description: conclusions resulting from the review of the ICT risk management
        framework;
      translations:
        fr:
          description: "les conclusions r\xE9sultant du r\xE9examen du cadre de gestion\
            \ du risque li\xE9 aux TIC;"
    - urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:27.2.k
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:27.2
      ref_id: 27.2.k
      description: 'information on past reviews, including:'
      translations:
        fr:
          description: "des informations sur les r\xE9examens ant\xE9rieurs, comprenant:"
    - urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:27.2.k.i
      assessable: true
      depth: 6
      parent_urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:27.2.k
      ref_id: 27.2.k.i
      description: a list of past reviews to date;
      translations:
        fr:
          description: "une liste des r\xE9examens ant\xE9rieurs;"
    - urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:27.2.k.ii
      assessable: true
      depth: 6
      parent_urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:27.2.k
      ref_id: 27.2.k.ii
      description: where applicable, a state of implementation of the corrective measures
        identified by the last report;
      translations:
        fr:
          description: "le cas \xE9ch\xE9ant, un \xE9tat d\u2019avancement de la mise\
            \ en \u0153uvre des mesures correctives d\xE9termin\xE9es dans le dernier\
            \ rapport;"
    - urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:27.2.k.iii
      assessable: true
      depth: 6
      parent_urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:27.2.k
      ref_id: 27.2.k.iii
      description: where the proposed corrective measures in past reviews have proven
        ineffective or have created unexpected challenges, a description of how those
        corrective measures could be improved or of those unexpected challenges;
      translations:
        fr:
          description: "lorsque les mesures correctives propos\xE9es lors des r\xE9\
            examens pr\xE9c\xE9dents se sont r\xE9v\xE9l\xE9es inefficaces ou ont\
            \ cr\xE9\xE9 des difficult\xE9s inattendues, une description de la mani\xE8\
            re dont ces mesures correctives pourraient \xEAtre am\xE9lior\xE9es ou\
            \ de ces difficult\xE9s impr\xE9vues;"
    - urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:27.2.l
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:27.2
      ref_id: 27.2.l
      description: 'sources of information used in the preparation of the report,
        including all of the following:'
      translations:
        fr:
          description: "les sources d\u2019information utilis\xE9es pour l\u2019\xE9\
            laboration du rapport, y compris l\u2019ensemble des \xE9l\xE9ments suivants:"
    - urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:27.2.l.i
      assessable: true
      depth: 6
      parent_urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:27.2.l
      ref_id: 27.2.l.i
      description: for financial entities other than microenterprises as referred
        to in Article 6(6) of Regulation (EU) 2022/2554, the results of internal audits;
      translations:
        fr:
          description: "pour les entit\xE9s financi\xE8res, autres que les microentreprises,\
            \ vis\xE9es \xE0 l\u2019article 6, paragraphe 6, du r\xE8glement (UE)\
            \ 2022/2554, les r\xE9sultats des audits internes;"
    - urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:27.2.l.ii
      assessable: true
      depth: 6
      parent_urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:27.2.l
      ref_id: 27.2.l.ii
      description: the results of compliance assessments;
      translations:
        fr:
          description: "les r\xE9sultats des \xE9valuations de la conformit\xE9;"
    - urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:27.2.l.iii
      assessable: true
      depth: 6
      parent_urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:27.2.l
      ref_id: 27.2.l.iii
      description: 'results of digital operational resilience testing, and where applicable
        the

        results of advanced testing, based on threat-led penetration testing (TLPT),

        of ICT tools, systems, and processes;'
      translations:
        fr:
          description: "les r\xE9sultats des tests de r\xE9silience op\xE9rationnelle\
            \ num\xE9rique et, le cas \xE9ch\xE9ant, les r\xE9sultats des tests avanc\xE9\
            s des outils de TIC, des syst\xE8mes de TIC et des processus de TIC sur\
            \ la base de tests de p\xE9n\xE9tration fond\xE9s sur la menace;"
    - urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:27.2.l.iv
      assessable: true
      depth: 6
      parent_urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:27.2.l
      ref_id: 27.2.l.iv
      description: external sources.
      translations:
        fr:
          description: les sources externes.
    - urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:article-27:1
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:article-27
      description: For the purposes of point (c), where the review was initiated following
        supervisory instructions, or conclusions derived from relevant digital operational
        resilience testing or audit processes, the report shall contain explicit references
        to such instructions or conclusions, allowing for the identification of the
        reason for initiating the review. Where the review was initiated following
        ICT-related incidents, the report shall contain the list of all ICT related
        incidents with incident root-cause analysis.
      translations:
        fr:
          description: "Aux fins du point c), lorsque le r\xE9examen a \xE9t\xE9 engag\xE9\
            \ \xE0 la suite d\u2019instructions des autorit\xE9s de surveillance ou\
            \ \xE0 la suite des conclusions tir\xE9es des tests de r\xE9silience op\xE9\
            rationnelle num\xE9rique ou des processus d\u2019audit pertinents, le\
            \ rapport contient des r\xE9f\xE9rences explicites \xE0 ces instructions\
            \ ou conclusions, permettant d\u2019identifier la raison du r\xE9examen.\
            \ Lorsque le r\xE9examen a \xE9t\xE9 engag\xE9 \xE0 la suite d\u2019incidents\
            \ li\xE9s aux TIC, le rapport contient la liste de tous les incidents\
            \ li\xE9s aux TIC accompagn\xE9e d\u2019une analyse de la cause originelle\
            \ des incidents."
    - urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:article-27:2
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:article-27
      description: For the purposes of point (f), the description shall contain an
        analysis of the impact of the changes on the financial entity's digital operational
        resilience strategy, on the financial entity's ICT internal control framework,
        and on the financial entity's ICT risk management governance.
      translations:
        fr:
          description: "Aux fins du point f), la description contient une analyse\
            \ de l\u2019incidence des modifications sur la strat\xE9gie de r\xE9silience\
            \ op\xE9rationnelle num\xE9rique de l\u2019entit\xE9 financi\xE8re, sur\
            \ le cadre de contr\xF4le interne des TIC de l\u2019entit\xE9 financi\xE8\
            re et sur la gouvernance de la gestion du risque li\xE9 aux TIC de l\u2019\
            entit\xE9 financi\xE8re."
    - urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:title-iii
      assessable: false
      depth: 1
      ref_id: TITLE III
      description: SIMPLIFIED ICT RISK MANAGEMENT FRAMEWORK FOR FINANCIAL ENTITIES
        REFERRED TO IN ARTICLE 16(1) OF REGULATION (EU) 2022/2554
      translations:
        fr:
          name: TITRE III
          description: "CADRE SIMPLIFI\xC9 DE GESTION DU RISQUE LI\xC9 AUX TIC POUR\
            \ LES ENTIT\xC9S FINANCI\xC8RES VIS\xC9ES \xC0 L\u2019ARTICLE 16, PARAGRAPHE\
            \ 1, DU R\xC8GLEMENT (UE) 2022/2554"
    - urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:title-iii:1
      assessable: false
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:title-iii
      name: CHAPTER I
      description: SIMPLIFIED ICT RISK MANAGEMENT FRAMEWORK
      translations:
        fr:
          name: CHAPITRE I
          description: "Cadre simplifi\xE9 de gestion du risque li\xE9 aux TIC"
    - urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:article-28
      assessable: false
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:title-iii:1
      ref_id: Article 28
      description: Governance and organisation
      translations:
        fr:
          description: Gouvernance et organisation
    - urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:28.1
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:article-28
      ref_id: '28.1'
      description: The financial entities referred to in Article 16(1) of Regulation
        (EU) 2022/2554 shall have in place an internal governance and control framework
        that ensures an effective and prudent management of ICT risk to achieve a
        high level of digital operational resilience.
      translations:
        fr:
          description: "Les entit\xE9s financi\xE8res vis\xE9es \xE0 l\u2019article\
            \ 16, paragraphe 1, du r\xE8glement (UE) 2022/2554 disposent d\u2019un\
            \ cadre de gouvernance et de contr\xF4le interne qui garantit une gestion\
            \ efficace et prudente du risque li\xE9 aux TIC, en vue d\u2019atteindre\
            \ un niveau \xE9lev\xE9 de r\xE9silience op\xE9rationnelle num\xE9rique."
    - urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:28.2
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:article-28
      ref_id: '28.2'
      description: 'The financial entities referred to in paragraph 1 shall, as part
        of their simplified ICT risk management framework, ensure that their management
        body:'
      translations:
        fr:
          description: "Les entit\xE9s financi\xE8res vis\xE9es au paragraphe 1 veillent,\
            \ au titre de leur cadre simplifi\xE9 de gestion du risque li\xE9 aux\
            \ TIC, \xE0 ce que leur organe de direction:"
    - urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:28.2.a
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:28.2
      ref_id: 28.2.a
      description: "bears the overall responsibility for ensuring that the simplified\
        \ ICT risk management framework allows for the achievement of the financial\
        \ entity\u2019s business strategy in accordance with the risk appetite of\
        \ that financial entity, and ensures that ICT risk is considered in that context;"
      translations:
        fr:
          description: "assume la responsabilit\xE9 globale de veiller \xE0 ce que\
            \ le cadre simplifi\xE9 de gestion du risque li\xE9 aux TIC permette de\
            \ r\xE9aliser la strat\xE9gie d\u2019entreprise de l\u2019entit\xE9 financi\xE8\
            re conform\xE9ment \xE0 l\u2019app\xE9tit pour le risque de cette entit\xE9\
            \ financi\xE8re, et veille \xE0 ce que le risque li\xE9 aux TIC soit pris\
            \ en consid\xE9ration dans ce contexte;"
    - urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:28.2.b
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:28.2
      ref_id: 28.2.b
      description: sets clear roles and responsibilities for all ICT-related tasks;
      translations:
        fr:
          description: "d\xE9finisse clairement les r\xF4les et les responsabilit\xE9\
            s pour toutes les t\xE2ches relatives aux TIC;"
    - urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:28.2.c
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:28.2
      ref_id: 28.2.c
      description: sets out information security objectives and ICT requirements;
      translations:
        fr:
          description: "d\xE9finisse les objectifs en mati\xE8re de s\xE9curit\xE9\
            \ de l\u2019information et les exigences en mati\xE8re de TIC;"
    - urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:28.2.d
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:28.2
      ref_id: 28.2.d
      description: 'approves, oversees, and periodically reviews:'
      translations:
        fr:
          description: "approuve, supervise et r\xE9examine p\xE9riodiquement:"
    - urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:28.2.d.i
      assessable: true
      depth: 6
      parent_urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:28.2.d
      ref_id: 28.2.d.i
      description: the classification of information assets of the financial entity
        as referred to in Article 30(1) of this Regulation, the list of main risks
        identified, and the business impact analysis and related policies;
      translations:
        fr:
          description: "la classification des actifs informationnels de l\u2019entit\xE9\
            \ financi\xE8re vis\xE9e \xE0 l\u2019article 30, paragraphe 1, du pr\xE9\
            sent r\xE8glement, la liste des principaux risques identifi\xE9s et l\u2019\
            analyse des incidences sur les activit\xE9s ainsi que les politiques connexes;"
    - urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:28.2.d.ii
      assessable: true
      depth: 6
      parent_urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:28.2.d
      ref_id: 28.2.d.ii
      description: the business continuity plans of the financial entity, and the
        response and recovery measures referred to in Article 16(1), point (f), of
        Regulation (EU) 2022/2554;
      translations:
        fr:
          description: "les plans de continuit\xE9 des activit\xE9s de l\u2019entit\xE9\
            \ financi\xE8re ainsi que les mesures de r\xE9ponse et de r\xE9tablissement\
            \ vis\xE9s \xE0 l\u2019article 16, paragraphe 1, point f), du r\xE8glement\
            \ (UE) 2022/2554;"
    - urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:28.2.e
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:28.2
      ref_id: 28.2.e
      description: "allocates and reviews at least once a year the budget necessary\
        \ to fulfil the financial entity\u2019s digital operational resilience needs\
        \ in respect of all types of resources, including relevant ICT security awareness\
        \ programmes and digital operational resilience training and ICT skills for\
        \ all staff;"
      translations:
        fr:
          description: "alloue et r\xE9examine au moins une fois par an le budget\
            \ n\xE9cessaire pour satisfaire les besoins de l\u2019entit\xE9 financi\xE8\
            re en mati\xE8re de r\xE9silience op\xE9rationnelle num\xE9rique pour\
            \ tous les types de ressources, y compris les programmes pertinents de\
            \ sensibilisation \xE0 la s\xE9curit\xE9 des TIC et les formations pertinentes\
            \ \xE0 la r\xE9silience op\xE9rationnelle num\xE9rique et les comp\xE9\
            tences en mati\xE8re de TIC pour l\u2019ensemble du personnel;"
    - urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:28.2.f
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:28.2
      ref_id: 28.2.f
      description: specifies and implements the policies and measures included in
        Chapters I, II and III of this Title to identify, assess and manage the ICT
        risk the financial entity is exposed to;
      translations:
        fr:
          description: "pr\xE9cise et met en \u0153uvre les politiques et mesures\
            \ pr\xE9vues aux chapitres I, II et III du pr\xE9sent titre permettant\
            \ d\u2019identifier, d\u2019\xE9valuer et de g\xE9rer le risque li\xE9\
            \ aux TIC auquel l\u2019entit\xE9 financi\xE8re est expos\xE9e;"
    - urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:28.2.g
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:28.2
      ref_id: 28.2.g
      description: identifies and implements procedures, ICT protocols, and tools
        that are necessary to protect all information assets and ICT assets;
      translations:
        fr:
          description: "d\xE9finit et met en \u0153uvre les proc\xE9dures, les protocoles\
            \ TIC et les outils n\xE9cessaires \xE0 la protection de tous les actifs\
            \ informationnels et de TIC;"
    - urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:28.2.h
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:28.2
      ref_id: 28.2.h
      description: ensures that the staff of the financial entity is kept up to date
        with sufficient knowledge and skills to understand and assess ICT risk and
        its impact on the operations of the financial entity, commensurate to the
        ICT risk being managed;
      translations:
        fr:
          description: "veille au maintien \xE0 jour d\u2019un niveau suffisant de\
            \ connaissances et de comp\xE9tences du personnel de l\u2019entit\xE9\
            \ financi\xE8re permettant \xE0 ce dernier de comprendre et d\u2019\xE9\
            valuer le risque li\xE9 aux TIC et son incidence sur les op\xE9rations\
            \ de l\u2019entit\xE9 financi\xE8re, de fa\xE7on proportionn\xE9e au risque\
            \ li\xE9 aux TIC g\xE9r\xE9;"
    - urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:28.2.i
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:28.2
      ref_id: 28.2.i
      description: establishes reporting arrangements, including the frequency, form,
        and content of reporting to the management body on the information security
        and digital operational resilience
      translations:
        fr:
          description: "\xE9tablit des modalit\xE9s d\u2019\xE9tablissement de rapports,\
            \ y compris la fr\xE9quence, la forme et le contenu des rapports \xE0\
            \ l\u2019organe de direction sur la s\xE9curit\xE9 de l\u2019information\
            \ et la r\xE9silience op\xE9rationnelle num\xE9rique."
    - urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:28.3
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:article-28
      ref_id: '28.3'
      description: The financial entities referred to in paragraph 1 may, in accordance
        with Union and national sectoral law, outsource the tasks of verifying compliance
        with ICT risk management requirements to ICT intra-group or ICT third-party
        service providers. In case of such outsourcing, financial entities shall remain
        fully responsible for the verification of compliance with the ICT risk management
        requirements.
      translations:
        fr:
          description: "Les entit\xE9s financi\xE8res vis\xE9es au paragraphe 1 peuvent,\
            \ conform\xE9ment au droit de l\u2019Union et au droit sectoriel national,\
            \ externaliser les t\xE2ches de v\xE9rification du respect des exigences\
            \ en mati\xE8re de gestion du risque li\xE9 aux TIC \xE0 des prestataires\
            \ de services TIC intra-groupe ou \xE0 des prestataires tiers de services\
            \ TIC. Dans le cas d\u2019une telle externalisation, les entit\xE9s financi\xE8\
            res demeurent pleinement responsables de la v\xE9rification du respect\
            \ des exigences en mati\xE8re de gestion du risque li\xE9 aux TIC."
    - urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:28.4
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:article-28
      ref_id: '28.4'
      description: The financial entities referred to in paragraph 1 shall ensure
        an appropriate segregation and the independence of control functions and internal
        audit functions.
      translations:
        fr:
          description: "Les entit\xE9s financi\xE8res vis\xE9es au paragraphe 1 garantissent\
            \ une s\xE9paration et une ind\xE9pendance ad\xE9quates des fonctions\
            \ de contr\xF4le et des fonctions d\u2019audit interne."
    - urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:28.5
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:article-28
      ref_id: '28.5'
      description: "The financial entities referred to in paragraph 1 shall ensure\
        \ that their simplified ICT risk management framework is subject to an internal\
        \ audit by auditors, in line with the financial entities\u2019 audit plan.\
        \ The auditors shall have sufficient knowledge, skills, and expertise in ICT\
        \ risk, and shall be independent. The frequency and focus of ICT audits shall\
        \ be commensurate to the ICT risk of the financial entity"
      translations:
        fr:
          description: "Les entit\xE9s financi\xE8res vis\xE9es au paragraphe 1 veillent\
            \ \xE0 ce que leur cadre simplifi\xE9 de gestion du risque li\xE9 aux\
            \ TIC fasse l\u2019objet d\u2019un audit interne r\xE9alis\xE9 par des\
            \ auditeurs conform\xE9ment au plan d\u2019audit de ces entit\xE9s financi\xE8\
            res. Ces auditeurs disposent de connaissances, de comp\xE9tences et d\u2019\
            une expertise suffisantes en mati\xE8re de risque li\xE9 aux TIC, et sont\
            \ ind\xE9pendants. La fr\xE9quence et l\u2019objectif des audits des TIC\
            \ sont proportionn\xE9s au risque li\xE9 aux TIC de l\u2019entit\xE9 financi\xE8\
            re."
    - urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:28.6
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:article-28
      ref_id: '28.6'
      description: Based on the outcome of the audit referred to in paragraph 5, the
        financial entities referred to in paragraph 1 shall ensure the timely verification
        and remediation of critical ICT audit findings.
      translations:
        fr:
          description: "Sur la base des r\xE9sultats de l\u2019audit vis\xE9 au paragraphe\
            \ 5, les entit\xE9s financi\xE8res vis\xE9es au paragraphe 1 veillent\
            \ \xE0 la v\xE9rification et \xE0 la correction en temps utile des constatations\
            \ d\u2019importance critique de l\u2019audit des TIC."
    - urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:article-29
      assessable: false
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:title-iii:1
      ref_id: Article 29
      description: Information security policy and measures
      translations:
        fr:
          description: "Politique et mesures en mati\xE8re de s\xE9curit\xE9 de l\u2019\
            information"
    - urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:29.1
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:article-29
      ref_id: '29.1'
      description: The financial entities referred to in Article 16(1) of Regulation
        (EU) 2022/2554 shall develop, document, and implement an information security
        policy in the context of the simplified ICT risk management framework. That
        information security policy shall specify the high-level principles and rules
        to protect the confidentiality, integrity, availability, and authenticity
        of data and of the services those financial entities provide.
      translations:
        fr:
          description: "Les entit\xE9s financi\xE8res vis\xE9es \xE0 l\u2019article\
            \ 16, paragraphe 1, du r\xE8glement (UE) 2022/2554 \xE9laborent, documentent\
            \ et mettent en \u0153uvre une politique de s\xE9curit\xE9 de l\u2019\
            information dans le contexte du cadre simplifi\xE9 de gestion du risque\
            \ li\xE9 aux TIC. Cette politique de s\xE9curit\xE9 de l\u2019information\
            \ pr\xE9cise les principes et r\xE8gles g\xE9n\xE9raux visant \xE0 prot\xE9\
            ger la confidentialit\xE9, l\u2019int\xE9grit\xE9, la disponibilit\xE9\
            \ et l\u2019authenticit\xE9 des donn\xE9es et des services fournis par\
            \ ces entit\xE9s financi\xE8res."
    - urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:29.2
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:article-29
      ref_id: '29.2'
      description: Based on their information security policy referred to in paragraph
        1, the financial entities referred to in paragraph 1 shall establish and implement
        ICT security measures to mitigate their exposure to ICT risk, including mitigating
        measures implemented by ICT third-party service providers.
      translations:
        fr:
          description: "Sur la base de leur politique en mati\xE8re de s\xE9curit\xE9\
            \ de l\u2019information vis\xE9e au paragraphe 1, les entit\xE9s financi\xE8\
            res vis\xE9es au paragraphe 1 \xE9tablissent et mettent en \u0153uvre\
            \ des mesures de s\xE9curit\xE9 des TIC pour att\xE9nuer leur exposition\
            \ au risque li\xE9 aux TIC, y compris des mesures d\u2019att\xE9nuation\
            \ mises en \u0153uvre par des prestataires tiers de services TIC."
    - urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:article-29:1
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:article-29
      description: The ICT security measures shall include all of the measures referred
        to in Articles 30 to 38.
      translations:
        fr:
          description: "Les mesures de s\xE9curit\xE9 des TIC comprennent toutes les\
            \ mesures vis\xE9es aux articles 30 \xE0 38."
    - urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:article-30
      assessable: false
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:title-iii:1
      ref_id: Article 30
      description: Classification of information assets and ICT assets
      translations:
        fr:
          description: Classification des actifs informationnels et des actifs de
            TIC
    - urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:30.1
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:article-30
      ref_id: '30.1'
      description: As part of the simplified ICT risk management framework referred
        to in Article 16(1), point (a), of Regulation (EU) 2022/2554, the financial
        entities referred to in paragraph 1 of that Article shall identify, classify,
        and document all critical or important functions, the information assets and
        ICT assets supporting them and their interdependencies. Financial entities
        shall review that identification and classification as needed.
      translations:
        fr:
          description: "Au titre du cadre simplifi\xE9 de gestion du risque li\xE9\
            \ aux TIC vis\xE9 \xE0 l\u2019article 16, paragraphe 1, point a), du r\xE8\
            glement (UE) 2022/2554, les entit\xE9s financi\xE8res vis\xE9es au paragraphe\
            \ 1 dudit article identifient, classent et documentent toutes les fonctions\
            \ critiques ou importantes, les actifs informationnels et les actifs de\
            \ TIC qui les soutiennent ainsi que leurs interd\xE9pendances. Les entit\xE9\
            s financi\xE8res r\xE9examinent cette identification et cette classification\
            \ en tant que de besoin."
    - urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:30.2
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:article-30
      ref_id: '30.2'
      description: The financial entities referred to in paragraph 1 shall identify
        all critical or important functions supported by ICT third-party service providers.
      translations:
        fr:
          description: "Les entit\xE9s financi\xE8res vis\xE9es au paragraphe 1 identifient\
            \ toutes les fonctions critiques ou importantes soutenues par des prestataires\
            \ tiers de services TIC."
    - urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:article-31
      assessable: false
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:title-iii:1
      ref_id: Article 31
      description: ICT risk management
      translations:
        fr:
          description: "Gestion du risque li\xE9 aux TIC"
    - urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:31.1
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:article-31
      ref_id: '31.1'
      description: 'The financial entities referred to in Article 16(1) of Regulation
        (EU) 2022/2554 shall include in their simplified ICT risk management framework
        all of the following :'
      translations:
        fr:
          description: "Les entit\xE9s financi\xE8res vis\xE9es \xE0 l\u2019article\
            \ 16, paragraphe 1, du r\xE8glement (UE) 2022/2554 incluent dans leur\
            \ cadre simplifi\xE9 de gestion du risque li\xE9 aux TIC l\u2019ensemble\
            \ des \xE9l\xE9ments suivants:"
    - urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:31.1.a
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:31.1
      ref_id: 31.1.a
      description: a determination of the risk tolerance levels for ICT risk, in accordance
        with the risk appetite of the financial entity;
      translations:
        fr:
          description: "une d\xE9termination des niveaux de tol\xE9rance au risque\
            \ li\xE9 aux TIC, en fonction de l\u2019app\xE9tit pour le risque de l\u2019\
            entit\xE9 financi\xE8re;"
    - urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:31.1.b
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:31.1
      ref_id: 31.1.b
      description: the identification and assessment of the ICT risks to which the
        financial entity is exposed;
      translations:
        fr:
          description: "l\u2019identification et l\u2019\xE9valuation des risques\
            \ li\xE9s aux TIC auxquels l\u2019entit\xE9 financi\xE8re est expos\xE9\
            e;"
    - urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:31.1.c
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:31.1
      ref_id: 31.1.c
      description: the specification of mitigation strategies at least for the ICT
        risks that are not within the risk tolerance levels of the financial entity;
      translations:
        fr:
          description: "la d\xE9finition de strat\xE9gies d\u2019att\xE9nuation, au\
            \ moins pour les risques li\xE9s aux TIC qui d\xE9passent les niveaux\
            \ de tol\xE9rance au risque de l\u2019entit\xE9 financi\xE8re;"
    - urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:31.1.d
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:31.1
      ref_id: 31.1.d
      description: the monitoring of the effectiveness of the mitigation strategies
        referred to in point (c);
      translations:
        fr:
          description: "le suivi de l\u2019efficacit\xE9 des strat\xE9gies d\u2019\
            att\xE9nuation vis\xE9es au point c);"
    - urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:31.1.e
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:31.1
      ref_id: 31.1.e
      description: the identification and assessment of any ICT and information security
        risks resulting from any major change in ICT system or ICT services, processes,
        or procedures, and from ICT security testing results and after any major ICT-related
        incident.
      translations:
        fr:
          description: "l\u2019identification et l\u2019\xE9valuation de tout risque\
            \ li\xE9 aux TIC ou en mati\xE8re de s\xE9curit\xE9 de l\u2019information\
            \ r\xE9sultant de tout changement majeur dans les syst\xE8mes de TIC ou\
            \ les services TIC, les processus ou les proc\xE9dures, ou r\xE9v\xE9\
            l\xE9 par les r\xE9sultats des tests de s\xE9curit\xE9 des TIC ou apr\xE8\
            s tout incident majeur li\xE9 aux TIC."
    - urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:31.2
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:article-31
      ref_id: '31.2'
      description: "The financial entities referred to in paragraph 1 shall carry\
        \ out and document the ICT risk assessment periodically commensurate to the\
        \ financial entities\u2019 ICT risk profile."
      translations:
        fr:
          description: "Les entit\xE9s financi\xE8res vis\xE9es au paragraphe 1 effectuent\
            \ et documentent p\xE9riodiquement l\u2019\xE9valuation du risque li\xE9\
            \ aux TIC, de fa\xE7on proportionn\xE9e \xE0 leur profil de risque li\xE9\
            \ aux TIC."
    - urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:31.3
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:article-31
      ref_id: '31.3'
      description: The financial entities referred to in paragraph 1 shall continuously
        monitor threats and vulnerabilities that are relevant to their critical or
        important functions, and information assets and ICT assets, and shall regularly
        review the risk scenarios impacting those critical or important functions.
      translations:
        fr:
          description: "Les entit\xE9s financi\xE8res vis\xE9es au paragraphe 1 surveillent\
            \ en permanence les menaces et les vuln\xE9rabilit\xE9s qui concernent\
            \ leurs fonctions critiques ou importantes, ainsi que les actifs informationnels\
            \ et les actifs de TIC, et r\xE9examinent r\xE9guli\xE8rement les sc\xE9\
            narios de risque ayant une incidence sur ces fonctions critiques ou importantes."
    - urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:31.4
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:article-31
      ref_id: '31.4'
      description: The financial entities referred to in paragraph 1 shall set out
        alert thresholds and criteria to trigger and initiate ICT-related incident
        response processes.
      translations:
        fr:
          description: "Les entit\xE9s financi\xE8res vis\xE9es au paragraphe 1 d\xE9\
            finissent des seuils d\u2019alerte et des crit\xE8res de d\xE9clenchement\
            \ et de lancement des processus de r\xE9ponse en cas d\u2019incident li\xE9\
            \ aux TIC."
    - urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:article-32
      assessable: false
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:title-iii:1
      ref_id: Article 32
      description: Physical and environmental security
      translations:
        fr:
          description: "S\xE9curit\xE9 physique et environnementale"
    - urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:32.1
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:article-32
      ref_id: '32.1'
      description: The financial entities referred to in Article 16(1) of Regulation
        (EU) 2022/2554 shall identify and implement physical security measures designed
        on the basis of the threat landscape and in accordance with the classification
        referred to in Article 30(1) of this Regulation, the overall risk profile
        of ICT assets, and accessible information assets.
      translations:
        fr:
          description: "Les entit\xE9s financi\xE8res vis\xE9es \xE0 l\u2019article\
            \ 16, paragraphe 1, du r\xE8glement (UE) 2022/2554 d\xE9finissent et mettent\
            \ en \u0153uvre des mesures de s\xE9curit\xE9 physique con\xE7ues sur\
            \ la base de l\u2019\xE9ventail des menaces et conform\xE9ment \xE0 la\
            \ classification vis\xE9e \xE0 l\u2019article 30, paragraphe 1, du pr\xE9\
            sent r\xE8glement, au profil de risque global des actifs de TIC et aux\
            \ actifs informationnels accessibles."
    - urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:32.2
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:article-32
      ref_id: '32.2'
      description: The measures referred to in paragraph 1 shall protect the premises
        of financial entities and, where applicable, data centres of financial entities
        where ICT assets and information assets reside from unauthorised access, attacks,
        and accidents, and from environmental threats and hazards.
      translations:
        fr:
          description: "Les mesures vis\xE9es au paragraphe 1 prot\xE8gent les locaux\
            \ des entit\xE9s financi\xE8res et, le cas \xE9ch\xE9ant, les centres\
            \ de donn\xE9es des entit\xE9s financi\xE8res dans lesquels les actifs\
            \ de TIC et les actifs informationnels sont situ\xE9s contre les acc\xE8\
            s non autoris\xE9s, les attaques et les accidents, ainsi que contre les\
            \ menaces et dangers environnementaux."
    - urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:32.3
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:article-32
      ref_id: '32.3'
      description: The protection from environmental threats and hazards shall be
        commensurate with the importance of the premises concerned and, where applicable,
        the data centres and the criticality of the operations or ICT systems located
        therein.
      translations:
        fr:
          description: "La protection contre les menaces et dangers environnementaux\
            \ est proportionn\xE9e \xE0 l\u2019importance des locaux concern\xE9s\
            \ et, le cas \xE9ch\xE9ant, des centres de donn\xE9es et \xE0 la criticit\xE9\
            \ des op\xE9rations ou des syst\xE8mes de TIC qui y sont situ\xE9s."
    - urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:title-iii:2
      assessable: false
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:title-iii
      name: CHAPTER II
      description: FURTHER ELEMENTS OF SYSTEMS, PROTOCOLS, AND TOOLS TO MINIMISE THE
        IMPACT OF ICT RISK
      translations:
        fr:
          name: CHAPITRE II
          description: "Autres \xE9l\xE9ments des syst\xE8mes, protocoles et outils\
            \ visant \xE0 r\xE9duire au minimum l\u2019incidence du risque li\xE9\
            \ aux TIC"
    - urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:article-33
      assessable: false
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:title-iii:2
      ref_id: Article 33
      description: Access Control
      translations:
        fr:
          description: "Contr\xF4le d\u2019acc\xE8s"
    - urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:33.1
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:article-33
      ref_id: '33.1'
      description: 'The financial entities referred to in Article 16(1) of Regulation
        (EU) 2022/2554 shall develop, document, and implement procedures for the control
        of logical and physical access and shall enforce, monitor, and periodically
        review those procedures. Those procedures shall contain the following elements
        of control of logical and physical access:'
      translations:
        fr:
          description: "Les entit\xE9s financi\xE8res vis\xE9es \xE0 l\u2019article\
            \ 16, paragraphe 1, du r\xE8glement (UE) 2022/2554 \xE9laborent, documentent\
            \ et mettent en \u0153uvre des proc\xE9dures de contr\xF4le des acc\xE8\
            s logiques et physiques, et appliquent, contr\xF4lent et r\xE9examinent\
            \ p\xE9riodiquement ces proc\xE9dures. Ces proc\xE9dures comportent les\
            \ \xE9l\xE9ments suivants de contr\xF4le des acc\xE8s logiques et physiques:"
    - urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:33.1.a
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:33.1
      ref_id: 33.1.a
      description: access rights to information assets, ICT assets, and their supported
        functions, and to critical locations of operation of the financial entity,
        are managed on a need-to-know, need-to-use and least privileges basis, including
        for remote and emergency access;
      translations:
        fr:
          description: "les droits d\u2019acc\xE8s aux actifs informationnels, aux\
            \ actifs de TIC et aux fonctions que ces actifs soutiennent, ainsi qu\u2019\
            aux sites critiques d\u2019exploitation de l\u2019entit\xE9 financi\xE8\
            re, sont g\xE9r\xE9s selon les principes du besoin d\u2019en conna\xEE\
            tre, du besoin d\u2019en disposer et du droit d\u2019acc\xE8s minimal,\
            \ y compris pour l\u2019acc\xE8s \xE0 distance et l\u2019acc\xE8s d\u2019\
            urgence;"
    - urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:33.1.b
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:33.1
      ref_id: 33.1.b
      description: user accountability, which ensures that users can be identified
        for the actions performed in the ICT systems;
      translations:
        fr:
          description: "la responsabilit\xE9 des utilisateurs, qui garantit que les\
            \ utilisateurs peuvent \xEAtre identifi\xE9s pour les actions effectu\xE9\
            es dans les syst\xE8mes de TIC;"
    - urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:33.1.c
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:33.1
      ref_id: 33.1.c
      description: account management procedures to grant, change, or revoke access
        rights for user and generic accounts, including generic administrator accounts;
      translations:
        fr:
          description: "les proc\xE9dures de gestion des comptes permettant d\u2019\
            accorder, de modifier ou de r\xE9voquer des droits d\u2019acc\xE8s pour\
            \ les comptes d\u2019utilisateurs et les comptes g\xE9n\xE9riques, y compris\
            \ les comptes g\xE9n\xE9riques d\u2019administrateur;"
    - urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:33.1.d
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:33.1
      ref_id: 33.1.d
      description: authentication methods that are commensurate to the classification
        referred to in Article 30(1) and to the overall risk profile of ICT assets,
        and which are based on leading practices;
      translations:
        fr:
          description: "des m\xE9thodes d\u2019authentification proportionn\xE9es\
            \ \xE0 la classification vis\xE9e \xE0 l\u2019article 30, paragraphe 1,\
            \ et au profil de risque global des actifs de TIC, et reposant sur les\
            \ pratiques de pointe;"
    - urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:33.1.e
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:33.1
      ref_id: 33.1.e
      description: access rights are periodically reviewed and are withdrawn when
        no longer required.
      translations:
        fr:
          description: "les droits d\u2019acc\xE8s sont r\xE9examin\xE9s p\xE9riodiquement\
            \ et retir\xE9s lorsqu\u2019ils ne sont plus n\xE9cessaires."
    - urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:article-33:1
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:article-33
      description: For the purposes of point (c), the financial entity shall assign
        privileged, emergency, and administrator access on a need-to-use or an ad-hoc
        basis for all ICT systems, and shall be logged in accordance with Article
        34(1), point (f).
      translations:
        fr:
          description: "Aux fins du point c), l\u2019entit\xE9 financi\xE8re attribue\
            \ des acc\xE8s privil\xE9gi\xE9s, d\u2019urgence et d\u2019administrateur\
            \ uniquement sur la base du besoin d\u2019en disposer ou au cas par cas\
            \ pour tous les syst\xE8mes de TIC. Ces acc\xE8s sont journalis\xE9s conform\xE9\
            ment \xE0 l\u2019article 34, premier alin\xE9a, point f)."
    - urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:article-33:2
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:article-33
      description: "For the purposes of point (d), financial entities shall use strong\
        \ authentication methods that are based on leading practices for remote access\
        \ to the financial entities\u2019 network, for privileged access, and for\
        \ access to ICT assets supporting critical or important functions that are\
        \ publicly available."
      translations:
        fr:
          description: "Aux fins du point d), les entit\xE9s financi\xE8res utilisent\
            \ des m\xE9thodes d\u2019authentification forte reposant sur les pratiques\
            \ de pointe pour l\u2019acc\xE8s \xE0 distance \xE0 leurs r\xE9seaux,\
            \ pour tout acc\xE8s privil\xE9gi\xE9 et pour l\u2019acc\xE8s aux actifs\
            \ de TIC soutenant des fonctions critiques ou importantes qui sont accessibles\
            \ au public."
    - urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:article-34
      assessable: false
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:title-iii:2
      ref_id: Article 34
      description: ICT operations security
      translations:
        fr:
          description: "S\xE9curit\xE9 des op\xE9rations de TIC"
    - urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:article-34:1
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:article-34
      description: 'The financial entities referred to in Article 16(1) of Regulation
        (EU) 2022/2554 shall, as part of their systems, protocols, and tools, and
        for all ICT assets:'
      translations:
        fr:
          description: "Dans le cadre de leurs syst\xE8mes, protocoles et outils,\
            \ et pour tous les actifs de TIC, les entit\xE9s financi\xE8res vis\xE9\
            es \xE0 l\u2019article 16, paragraphe 1, du r\xE8glement (UE) 2022/2554:"
    - urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:34.a
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:article-34:1
      ref_id: 34.a
      description: monitor and manage the lifecycle of all ICT assets;
      translations:
        fr:
          description: "suivent et g\xE8rent le cycle de vie de tous les actifs de\
            \ TIC;"
    - urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:34.b
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:article-34:1
      ref_id: 34.b
      description: monitor whether the ICT assets are supported by ICT third-party
        service providers of financial entities, where applicable;
      translations:
        fr:
          description: "surveillent si les actifs de TIC sont pris en charge par des\
            \ prestataires tiers de services TIC des entit\xE9s financi\xE8res, le\
            \ cas \xE9ch\xE9ant;"
    - urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:34.c
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:article-34:1
      ref_id: 34.c
      description: identify capacity requirements of their ICT assets and measures
        to maintain and improve the availability and efficiency of ICT systems and
        prevent ICT capacity shortages before they materialise;
      translations:
        fr:
          description: "d\xE9finissent les besoins en capacit\xE9s de leurs actifs\
            \ de TIC et les mesures visant \xE0 maintenir et \xE0 am\xE9liorer la\
            \ disponibilit\xE9 et l\u2019efficacit\xE9 des syst\xE8mes de TIC et \xE0\
            \ pr\xE9venir les d\xE9ficits de capacit\xE9s en mati\xE8re de TIC avant\
            \ qu\u2019ils ne se concr\xE9tisent;"
    - urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:34.d
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:article-34:1
      ref_id: 34.d
      description: perform automated vulnerability scanning and assessments of ICT
        assets commensurate to their classification as referred to in Article 30(1)
        and to the overall risk profile of the ICT asset, and deploy patches to address
        identified vulnerabilities;
      translations:
        fr:
          description: "effectuent des scans et \xE9valuations automatis\xE9s des\
            \ vuln\xE9rabilit\xE9s des actifs de TIC de fa\xE7on proportionn\xE9e\
            \ \xE0 leur classification vis\xE9e \xE0 l\u2019article 30, paragraphe\
            \ 1, et au profil de risque global de l\u2019actif de TIC, et d\xE9ploient\
            \ des correctifs pour rem\xE9dier aux vuln\xE9rabilit\xE9s identifi\xE9\
            es;"
    - urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:34.e
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:article-34:1
      ref_id: 34.e
      description: manage the risks related to outdated, unsupported, or legacy ICT
        assets;
      translations:
        fr:
          description: "g\xE8rent les risques li\xE9s aux actifs de TIC obsol\xE8\
            tes, non pris en charge ou h\xE9rit\xE9s;"
    - urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:34.f
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:article-34:1
      ref_id: 34.f
      description: log events related to logical and physical access control, ICT
        operations, including system and network traffic activities, and ICT change
        management;
      translations:
        fr:
          description: "journalisent les \xE9v\xE9nements li\xE9s au contr\xF4le des\
            \ acc\xE8s logiques et physiques, aux op\xE9rations de TIC, y compris\
            \ aux activit\xE9s li\xE9es aux syst\xE8mes et au trafic r\xE9seau, et\
            \ \xE0 la gestion des changements dans les TIC;"
    - urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:34.g
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:article-34:1
      ref_id: 34.g
      description: identify and implement measures to monitor and analyse information
        on anomalous activities and behaviour for critical or important ICT operations;
      translations:
        fr:
          description: "d\xE9finissent et mettent en \u0153uvre des mesures de suivi\
            \ et d\u2019analyse des informations sur les activit\xE9s et comportements\
            \ anormaux pour les op\xE9rations de TIC critiques ou importantes;"
    - urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:34.h
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:article-34:1
      ref_id: 34.h
      description: implement measures to monitor relevant and up-to-date information
        about cyber threats;
      translations:
        fr:
          description: "mettent en \u0153uvre des mesures de suivi des informations\
            \ pertinentes et actualis\xE9es sur les cybermenaces;"
    - urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:34.i
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:article-34:1
      ref_id: 34.i
      description: implement measures to identify possible information leakages, malicious
        code and other security threats, and publicly known vulnerabilities in software
        and hardware, and check for corresponding new security updates.
      translations:
        fr:
          description: "mettent en \u0153uvre des mesures visant \xE0 d\xE9tecter\
            \ les \xE9ventuelles fuites d\u2019informations, les codes malveillants\
            \ et les autres menaces pour la s\xE9curit\xE9, ainsi que les vuln\xE9\
            rabilit\xE9s de notori\xE9t\xE9 publique dans les logiciels et le mat\xE9\
            riel, et v\xE9rifient la disponibilit\xE9 de nouvelles mises \xE0 jour\
            \ de s\xE9curit\xE9 correspondantes."
    - urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:article-34:2
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:article-34
      description: For the purposes of point (f), financial entities shall align the
        level of detail of the logs with their purpose and usage of the ICT asset
        producing those logs.
      translations:
        fr:
          description: "Aux fins du point f), les entit\xE9s financi\xE8res adaptent\
            \ le niveau de d\xE9tail des journaux en fonction de leur finalit\xE9\
            \ et de leur utilisation des actifs de TIC produisant ces journaux."
    - urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:article-35
      assessable: false
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:title-iii:2
      ref_id: Article 35
      description: Data, system and network security
      translations:
        fr:
          description: "S\xE9curit\xE9 des donn\xE9es, des syst\xE8mes et des r\xE9\
            seaux"
    - urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:article-35:1
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:article-35
      description: 'The financial entities referred to in Article 16(1) of Regulation
        (EU) 2022/2554 shall, as part of their systems, protocols, and tools, develop
        and implement safeguards that ensure the security of networks against intrusions
        and data misuse and that preserve the availability, authenticity, integrity,
        and confidentiality of data. In particular, financial entities shall, taking
        into account the classification referred to in Article 30(1) of this Regulation,
        establish all of the following:'
      translations:
        fr:
          description: "Les entit\xE9s financi\xE8res vis\xE9es \xE0 l\u2019article\
            \ 16, paragraphe 1, du r\xE8glement (UE) 2022/2554 \xE9laborent et mettent\
            \ en \u0153uvre, dans le cadre de leurs syst\xE8mes, protocoles et outils,\
            \ des garanties pour assurer la protection des r\xE9seaux contre les intrusions\
            \ et les utilisations abusives des donn\xE9es et pr\xE9server la disponibilit\xE9\
            , l\u2019authenticit\xE9, l\u2019int\xE9grit\xE9 et la confidentialit\xE9\
            \ des donn\xE9es. En particulier, les entit\xE9s financi\xE8res mettent\
            \ en place, en tenant compte de la classification vis\xE9e \xE0 l\u2019\
            article 30, paragraphe 1, du pr\xE9sent r\xE8glement, l\u2019ensemble\
            \ des \xE9l\xE9ments suivants:"
    - urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:35.a
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:article-35:1
      ref_id: 35.a
      description: the identification and implementation of measures to protect data
        in use, in transit, and at rest;
      translations:
        fr:
          description: "la d\xE9finition et la mise en \u0153uvre de mesures visant\
            \ \xE0 prot\xE9ger les donn\xE9es en cours d\u2019utilisation, en transit\
            \ et au repos;"
    - urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:35.b
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:article-35:1
      ref_id: 35.b
      description: the identification and implementation of security measures regarding
        the use of software, data storage media, systems and endpoint devices that
        transfer and store data of the financial entity;
      translations:
        fr:
          description: "la d\xE9finition et la mise en \u0153uvre de mesures de s\xE9\
            curit\xE9 concernant l\u2019utilisation de logiciels, de supports de stockage\
            \ de donn\xE9es, de syst\xE8mes et de p\xE9riph\xE9riques de point de\
            \ terminaison qui transf\xE8rent et stockent des donn\xE9es de l\u2019\
            entit\xE9 financi\xE8re;"
    - urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:35.c
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:article-35:1
      ref_id: 35.c
      description: "the identification and implementation of measures to prevent and\
        \ detect unauthorised connections to the financial entity's network, and to\
        \ secure the network traffic between the financial entity\u2019s internal\
        \ networks and the internet and other external connections;"
      translations:
        fr:
          description: "la d\xE9finition et la mise en \u0153uvre de mesures visant\
            \ \xE0 pr\xE9venir et \xE0 d\xE9tecter les connexions non autoris\xE9\
            es au r\xE9seau de l\u2019entit\xE9 financi\xE8re et \xE0 s\xE9curiser\
            \ le trafic r\xE9seau entre les r\xE9seaux internes de l\u2019entit\xE9\
            \ financi\xE8re et l\u2019internet et d\u2019autres connexions externes;"
    - urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:35.d
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:article-35:1
      ref_id: 35.d
      description: the identification and implementation of measures that ensure the
        availability, authenticity, integrity, and confidentiality of data during
        network transmissions;
      translations:
        fr:
          description: "la d\xE9finition et la mise en \u0153uvre de mesures garantissant\
            \ la disponibilit\xE9, l\u2019authenticit\xE9, l\u2019int\xE9grit\xE9\
            \ et la confidentialit\xE9 des donn\xE9es lors des transmissions sur le\
            \ r\xE9seau;"
    - urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:35.e
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:article-35:1
      ref_id: 35.e
      description: a process to securely delete data on premises, or that are stored
        externally, that the financial entity no longer needs to collect or store;
      translations:
        fr:
          description: "un processus permettant de supprimer de mani\xE8re s\xE9curis\xE9\
            e les donn\xE9es dans les locaux, ou stock\xE9es \xE0 l\u2019ext\xE9rieur,\
            \ que l\u2019entit\xE9 financi\xE8re n\u2019a plus besoin de collecter\
            \ ou de stocker;"
    - urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:35.f
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:article-35:1
      ref_id: 35.f
      description: a process to securely dispose of, or decommission, data storage
        devices on premises, or data storage devices that are stored externally, that
        contain confidential information;
      translations:
        fr:
          description: "un processus permettant d\u2019\xE9liminer ou de d\xE9classer\
            \ de mani\xE8re s\xE9curis\xE9e des dispositifs de stockage de donn\xE9\
            es dans les locaux, ou des dispositifs de stockage des donn\xE9es stock\xE9\
            s \xE0 l\u2019ext\xE9rieur, qui contiennent des informations confidentielles;"
    - urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:35.g
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:article-35:1
      ref_id: 35.g
      description: "the identification and implementation of measures to ensure that\
        \ teleworking and the use of private endpoint devices does not adversely impact\
        \ the financial entity\u2019s ability to carry out its critical activities\
        \ in an adequate, timely, and secure manner."
      translations:
        fr:
          description: "la d\xE9finition et la mise en \u0153uvre de mesures visant\
            \ \xE0 garantir que le t\xE9l\xE9travail et l\u2019utilisation de p\xE9\
            riph\xE9riques de point de terminaison priv\xE9s n\u2019ont pas d\u2019\
            incidence n\xE9gative sur la capacit\xE9 de l\u2019entit\xE9 financi\xE8\
            re \xE0 mener ses activit\xE9s critiques de mani\xE8re ad\xE9quate, rapide\
            \ et s\xFBre."
    - urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:article-36
      assessable: false
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:title-iii:2
      ref_id: Article 36
      description: ICT security testing
      translations:
        fr:
          description: "Tests de s\xE9curit\xE9 des TIC"
    - urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:36.1
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:article-36
      ref_id: '36.1'
      description: The financial entities referred to in Article 16(1) of Regulation
        (EU) 2022/2554 shall establish and implement an ICT security testing plan
        to validate the effectiveness of their ICT security measures developed in
        accordance with Articles 33, 34 and 35 and Articles 37 and 38 of this Regulation.
        Financial entities shall ensure that that plan considers threats and vulnerabilities
        identified as part of the simplified ICT risk management framework referred
        to in Article 31 of this Regulation.
      translations:
        fr:
          description: "Les entit\xE9s financi\xE8res vis\xE9es \xE0 l\u2019article\
            \ 16, paragraphe 1, du r\xE8glement (UE) 2022/2554 \xE9tablissent et mettent\
            \ en \u0153uvre un plan de tests de s\xE9curit\xE9 des TIC afin de confirmer\
            \ l\u2019efficacit\xE9 de leurs mesures de s\xE9curit\xE9 des TIC \xE9\
            labor\xE9es conform\xE9ment aux articles 33, 34 et 35 et aux articles\
            \ 37 et 38 du pr\xE9sent r\xE8glement. Les entit\xE9s financi\xE8res veillent\
            \ \xE0 ce que ce plan tienne compte des menaces et des vuln\xE9rabilit\xE9\
            s identifi\xE9es au titre du cadre simplifi\xE9 de gestion du risque li\xE9\
            \ aux TIC vis\xE9 \xE0 l\u2019article 31 du pr\xE9sent r\xE8glement."
    - urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:36.2
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:article-36
      ref_id: '36.2'
      description: The financial entities referred to in paragraph 1 shall review,
        asses and test ICT security measures, taking into consideration the overall
        risk profile of the ICT assets of the financial entity.
      translations:
        fr:
          description: "Les entit\xE9s financi\xE8res vis\xE9es au paragraphe 1 examinent,\
            \ \xE9valuent et testent les mesures de s\xE9curit\xE9 des TIC, en tenant\
            \ compte du profil de risque global des actifs de TIC de l\u2019entit\xE9\
            \ financi\xE8re."
    - urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:36.3
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:article-36
      ref_id: '36.3'
      description: The financial entities referred to in paragraph 1 shall monitor
        and evaluate the results of the security tests and update their security measures
        accordingly without undue delay in the case of ICT systems supporting critical
        or important functions.
      translations:
        fr:
          description: "Les entit\xE9s financi\xE8res vis\xE9es au paragraphe 1 suivent\
            \ et \xE9valuent les r\xE9sultats des tests de s\xE9curit\xE9 et mettent\
            \ \xE0 jour leurs mesures de s\xE9curit\xE9 en cons\xE9quence, sans retard\
            \ injustifi\xE9, lorsque les syst\xE8mes de TIC concern\xE9s soutiennent\
            \ des fonctions critiques ou importantes."
    - urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:article-37
      assessable: false
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:title-iii:2
      ref_id: Article 37
      description: ICT systems acquisition, development, and maintenance
      translations:
        fr:
          description: "Acquisition, d\xE9veloppement et maintenance des syst\xE8\
            mes de TIC"
    - urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:article-37:1
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:article-37
      description: 'The financial entities referred to in Article 16(1) of Regulation
        (EU) 2022/2554 shall design and implement, where appropriate, a procedure
        governing the acquisition, development, and maintenance of ICT systems following
        a risk-based approach. That procedure shall:'
      translations:
        fr:
          description: "Les entit\xE9s financi\xE8res vis\xE9es \xE0 l\u2019article\
            \ 16, paragraphe 1, du r\xE8glement (UE) 2022/2554 con\xE7oivent et mettent\
            \ en \u0153uvre, le cas \xE9ch\xE9ant, une proc\xE9dure r\xE9gissant l\u2019\
            acquisition, le d\xE9veloppement et la maintenance de syst\xE8mes de TIC\
            \ selon une approche fond\xE9e sur les risques. Cette proc\xE9dure:"
    - urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:37.a
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:article-37:1
      ref_id: 37.a
      description: ensure that, before any acquisition or development of ICT systems
        takes place, the functional and non-functional requirements, including information
        security requirements, are clearly specified and approved by the business
        function concerned;
      translations:
        fr:
          description: "pr\xE9voit que, avant toute acquisition ou tout d\xE9veloppement\
            \ de syst\xE8mes de TIC, les exigences fonctionnelles et non fonctionnelles,\
            \ y compris les exigences en mati\xE8re de s\xE9curit\xE9 de l\u2019information,\
            \ sont clairement d\xE9finies et approuv\xE9es par la fonction \xABm\xE9\
            tier\xBB concern\xE9e;"
    - urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:37.b
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:article-37:1
      ref_id: 37.b
      description: ensure the testing and approval of ICT systems prior to their first
        use and before introducing changes to the production environment;
      translations:
        fr:
          description: "pr\xE9voit que les syst\xE8mes de TIC sont test\xE9s et approuv\xE9\
            s avant leur premi\xE8re utilisation et avant l\u2019introduction de changements\
            \ dans l\u2019environnement de production;"
    - urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:37.c
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:article-37:1
      ref_id: 37.c
      description: identify measures to mitigate the risk of unintentional alteration
        or intentional manipulation of the ICT systems during development and implementation
        in the production environment.
      translations:
        fr:
          description: "d\xE9finit les mesures visant \xE0 att\xE9nuer le risque d\u2019\
            alt\xE9ration involontaire ou de manipulation intentionnelle des syst\xE8\
            mes de TIC lors du d\xE9veloppement et de la mise en \u0153uvre dans l\u2019\
            environnement de production."
    - urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:article-38
      assessable: false
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:title-iii:2
      ref_id: Article 38
      description: ICT project and change management
      translations:
        fr:
          description: Gestion des projets de TIC et des changements dans les TIC
    - urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:38.1
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:article-38
      ref_id: '38.1'
      description: The financial entities referred to in Article 16(1) of Regulation
        (EU) 2022/2554 shall develop, document, and implement an ICT project management
        procedure and shall specify the roles and responsibilities for its implementation.
        That procedure shall cover all stages of the ICT projects from their initiation
        to their closure.
      translations:
        fr:
          description: "Les entit\xE9s financi\xE8res vis\xE9es \xE0 l\u2019article\
            \ 16, paragraphe 1, du r\xE8glement (UE) 2022/2554 \xE9laborent, documentent\
            \ et mettent en \u0153uvre une proc\xE9dure de gestion des projets de\
            \ TIC et pr\xE9cisent les r\xF4les et responsabilit\xE9s li\xE9s \xE0\
            \ sa mise en \u0153uvre. Cette proc\xE9dure couvre tous les stades des\
            \ projets de TIC, depuis leur lancement jusqu\u2019\xE0 leur cl\xF4ture."
    - urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:38.2
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:article-38
      ref_id: '38.2'
      description: "The financial entities referred to in paragraph 1 shall develop,\
        \ document, and implement an ICT change management procedure to ensure that\
        \ all changes to ICT systems are recorded, tested, assessed, approved, implemented,\
        \ and verified in a controlled manner and with the adequate safeguards to\
        \ preserve the financial entity\u2019s digital operational resilience."
      translations:
        fr:
          description: "Les entit\xE9s financi\xE8res vis\xE9es au paragraphe 1 \xE9\
            laborent, documentent et mettent en \u0153uvre une proc\xE9dure de gestion\
            \ des changements dans les TIC, afin de garantir que tous les changements\
            \ apport\xE9s aux syst\xE8mes de TIC sont consign\xE9s, test\xE9s, \xE9\
            valu\xE9s, approuv\xE9s, mis en \u0153uvre et v\xE9rifi\xE9s de mani\xE8\
            re contr\xF4l\xE9e et avec les garanties ad\xE9quates pour pr\xE9server\
            \ la r\xE9silience op\xE9rationnelle num\xE9rique de l\u2019entit\xE9\
            \ financi\xE8re."
    - urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:title-iii:3
      assessable: false
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:title-iii
      name: CHAPTER III
      description: ICT BUSINESS CONTINUITY MANAGEMENT
      translations:
        fr:
          name: CHAPITRE III
          description: "Gestion de la continuit\xE9 des activit\xE9s de TIC"
    - urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:article-39
      assessable: false
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:title-iii:3
      ref_id: Article 39
      description: Components of the ICT business continuity plan
      translations:
        fr:
          description: "Composantes du plan de continuit\xE9 des activit\xE9s de TIC"
    - urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:39.1
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:article-39
      ref_id: '39.1'
      description: The financial entities referred to in Article 16(1) of Regulation
        (EU) 2022/2554 shall develop their ICT business continuity plans considering
        the results of the analysis of their exposures to and potential impact of
        severe business disruptions and scenarios to which their ICT assets supporting
        critical or important functions might be exposed, including a cyber-attack
        scenario.
      translations:
        fr:
          description: "Les entit\xE9s financi\xE8res vis\xE9es \xE0 l\u2019article\
            \ 16, paragraphe 1, du r\xE8glement (UE) 2022/2554 \xE9laborent leurs\
            \ plans de continuit\xE9 des activit\xE9s de TIC en prenant en consid\xE9\
            ration les r\xE9sultats de l\u2019analyse de leurs expositions aux graves\
            \ perturbations des activit\xE9s et de leurs incidences potentielles,\
            \ ainsi que les sc\xE9narios auxquels leurs actifs de TIC qui soutiennent\
            \ des fonctions critiques ou importantes pourraient \xEAtre expos\xE9\
            s, y compris un sc\xE9nario de cyberattaque."
    - urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:39.2
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:article-39
      ref_id: '39.2'
      description: 'The ICT business continuity plans referred to in paragraph 1 shall:'
      translations:
        fr:
          description: "Les plans de continuit\xE9 des activit\xE9s de TIC vis\xE9\
            s au paragraphe 1:"
    - urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:39.2.a
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:39.2
      ref_id: 39.2.a
      description: be approved by the management body of the financial entity;
      translations:
        fr:
          description: "sont approuv\xE9s par l\u2019organe de direction de l\u2019\
            entit\xE9 financi\xE8re;"
    - urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:39.2.b
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:39.2
      ref_id: 39.2.b
      description: be documented and readily accessible in the event of an emergency
        or crisis;
      translations:
        fr:
          description: "sont document\xE9s et facilement accessibles en cas d\u2019\
            urgence ou de crise;"
    - urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:39.2.c
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:39.2
      ref_id: 39.2.c
      description: allocate sufficient resources for their execution;
      translations:
        fr:
          description: "affectent des ressources suffisantes \xE0 leur ex\xE9cution;"
    - urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:39.2.d
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:39.2
      ref_id: 39.2.d
      description: establish planned recovery levels and timeframes for the recovery
        and resumption of functions and key internal and external dependencies, including
        ICT third-party service providers;
      translations:
        fr:
          description: "\xE9tablissent les niveaux de r\xE9tablissement et les d\xE9\
            lais pr\xE9vus pour le r\xE9tablissement et la reprise des fonctions et\
            \ des principales relations de d\xE9pendance internes et externes, y compris\
            \ les prestataires tiers de services TIC;"
    - urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:39.2.e
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:39.2
      ref_id: 39.2.e
      description: "identify the conditions that may prompt the activation of the\
        \ ICT business continuity plans and what actions are to be taken to ensure\
        \ the availability, continuity, and recovery of the financial entities\u2019\
        \ ICT assets supporting critical or important functions;"
      translations:
        fr:
          description: "d\xE9finissent les conditions susceptibles de d\xE9clencher\
            \ l\u2019activation des plans de continuit\xE9 des activit\xE9s de TIC\
            \ et les mesures \xE0 prendre pour garantir la disponibilit\xE9, la continuit\xE9\
            \ et le r\xE9tablissement des actifs de TIC des entit\xE9s financi\xE8\
            res qui soutiennent des fonctions critiques ou importantes;"
    - urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:39.2.f
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:39.2
      ref_id: 39.2.f
      description: identify the restoration and recovery measures for critical or
        important business functions, supporting processes, information assets, and
        their interdependencies to avoid adverse effects on the functioning of the
        financial entities;
      translations:
        fr:
          description: "d\xE9finissent les mesures de restauration et de r\xE9tablissement\
            \ pour les fonctions \xABm\xE9tiers\xBB critiques ou importantes, les\
            \ processus de soutien, les actifs informationnels et leurs interd\xE9\
            pendances afin d\u2019\xE9viter des effets pr\xE9judiciables sur le fonctionnement\
            \ des entit\xE9s financi\xE8res;"
    - urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:39.2.g
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:39.2
      ref_id: 39.2.g
      description: identify backup procedures and measures that specify the scope
        of the data that are subject to the backup, and the minimum frequency of the
        backup, based on the criticality of the function using those data;
      translations:
        fr:
          description: "d\xE9finissent des proc\xE9dures et mesures de sauvegarde\
            \ qui pr\xE9cisent l\u2019\xE9tendue des donn\xE9es concern\xE9es par\
            \ la sauvegarde ainsi que la fr\xE9quence minimale de celle-ci, selon\
            \ la criticit\xE9 de la fonction qui utilise ces donn\xE9es;"
    - urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:39.2.h
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:39.2
      ref_id: 39.2.h
      description: consider alternative options where recovery may not be feasible
        in the short term because of costs, risks, logistics, or unforeseen circumstances;
      translations:
        fr:
          description: "pr\xE9voient d\u2019autres options pour le cas o\xF9 le r\xE9\
            tablissement ne serait pas r\xE9alisable \xE0 court terme en raison des\
            \ co\xFBts, des risques, de probl\xE8mes logistiques ou de circonstances\
            \ impr\xE9vues;"
    - urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:39.2.i
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:39.2
      ref_id: 39.2.i
      description: specify the internal and external communication arrangements, including
        escalation plans;
      translations:
        fr:
          description: "pr\xE9cisent les modalit\xE9s de communication interne et\
            \ externe, y compris les plans de remont\xE9e des informations;"
    - urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:39.2.j
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:39.2
      ref_id: 39.2.j
      description: "be updated in line with lessons learned from incidents, tests,\
        \ new risks, and threats identified, changed recovery objectives, major changes\
        \ to the financial entity\u2019s organisation, and to the ICT assets supporting\
        \ critical or business functions."
      translations:
        fr:
          description: "sont actualis\xE9s en fonction des enseignements tir\xE9s\
            \ des incidents, des tests, des nouveaux risques et des menaces identifi\xE9\
            s, des changements des objectifs de r\xE9tablissement, des changements\
            \ majeurs apport\xE9s \xE0 l\u2019organisation de l\u2019entit\xE9 financi\xE8\
            re et aux actifs de TIC qui soutiennent des fonctions critiques ou des\
            \ fonctions \xABm\xE9tiers\xBB."
    - urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:article-39:1
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:article-39
      description: For the purposes of point (f), the measures referred to in that
        point shall provide for the mitigation of failures of critical third-party
        providers.
      translations:
        fr:
          description: "Aux fins du point f), les mesures vis\xE9es audit point pr\xE9\
            voient l\u2019att\xE9nuation des d\xE9faillances des prestataires tiers\
            \ critiques."
    - urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:article-40
      assessable: false
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:title-iii:3
      ref_id: Article 40
      description: Testing of business continuity plans
      translations:
        fr:
          description: "Tests des plans de continuit\xE9 des activit\xE9s"
    - urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:40.1
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:article-40
      ref_id: '40.1'
      description: The financial entities referred to in Article 16(1) of Regulation
        (EU) 2022/2554 shall test their business continuity plans referred to in Article
        39 of this Regulation, including the scenarios referred to in that Article,
        at least once every year for the back up and restore procedures, or upon every
        major change of the business continuity plan.
      translations:
        fr:
          description: "Les entit\xE9s financi\xE8res vis\xE9es \xE0 l\u2019article\
            \ 16, paragraphe 1, du r\xE8glement (UE) 2022/2554 testent leurs plans\
            \ de continuit\xE9 des activit\xE9s vis\xE9s \xE0 l\u2019article 39 du\
            \ pr\xE9sent r\xE8glement, y compris les sc\xE9narios vis\xE9s audit article,\
            \ au moins une fois par an pour les proc\xE9dures de sauvegarde et de\
            \ restauration, ou \xE0 chaque modification majeure du plan de continuit\xE9\
            \ des activit\xE9s."
    - urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:40.2
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:article-40
      ref_id: '40.2'
      description: The testing of business continuity plans referred to in paragraph
        1 shall demonstrate that the financial entities referred to in that paragraph
        are able to sustain the viability of their businesses until critical operations
        are re-established and identify any deficiencies in those plans.
      translations:
        fr:
          description: "Les tests des plans de continuit\xE9 des activit\xE9s vis\xE9\
            s au paragraphe 1 doivent d\xE9montrer que les entit\xE9s financi\xE8\
            res vis\xE9es audit paragraphe sont en mesure de maintenir la viabilit\xE9\
            \ de leurs activit\xE9s jusqu\u2019\xE0 ce que les op\xE9rations critiques\
            \ soient r\xE9tablies et d\xE9tecter toute lacune de ces plans."
    - urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:40.3
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:article-40
      ref_id: '40.3'
      description: The financial entities referred to in paragraph 1 shall document
        the results of the testing of business continuity plans and any identified
        deficiencies resulting from that testing shall be analysed, addressed, and
        reported to the management body.
      translations:
        fr:
          description: "Les entit\xE9s financi\xE8res vis\xE9es au paragraphe 1 documentent\
            \ les r\xE9sultats des tests des plans de continuit\xE9 des activit\xE9\
            s et toute lacune constat\xE9e \xE0 la suite de ces tests est analys\xE9\
            e, trait\xE9e et notifi\xE9e \xE0 l\u2019organe de direction."
    - urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:title-iii:4
      assessable: false
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:title-iii
      name: CHAPTER IV
      description: REPORT ON THE REVIEW OF THE SIMPLIFIED ICT RISK MANAGEMENT FRAMEWORK
      translations:
        fr:
          name: CHAPITRE IV
          description: "Rapport sur le r\xE9examen du cadre simplifi\xE9 de gestion\
            \ du risque li\xE9 aux TIC"
    - urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:article-41
      assessable: false
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:title-iii:4
      ref_id: Article 41
      description: Format and content of the report on the review of the simplified
        ICT risk management framework
      translations:
        fr:
          description: "Format et contenu du rapport sur le r\xE9examen du cadre simplifi\xE9\
            \ de gestion du risque li\xE9 aux TIC"
    - urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:41.1
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:article-41
      ref_id: '41.1'
      description: The financial entities referred to in Article 16(1) of Regulation
        (EU) 2022/2554 shall submit the report on the review of the ICT risk management
        framework referred to in paragraph 2 of that Article in a searchable electronic
        format.
      translations:
        fr:
          description: "Les entit\xE9s financi\xE8res vis\xE9es \xE0 l\u2019article\
            \ 16, paragraphe 1, du r\xE8glement (UE) 2022/2554 pr\xE9sentent le rapport\
            \ sur le r\xE9examen du cadre de gestion du risque li\xE9 aux TIC vis\xE9\
            \ au paragraphe 2 dudit article dans un format \xE9lectronique interrogeable."
    - urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:41.2
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:article-41
      ref_id: '41.2'
      description: 'The report referred to in paragraph 1 shall contain all of the
        following information:'
      translations:
        fr:
          description: "Le rapport vis\xE9 au paragraphe 1 contient l\u2019ensemble\
            \ des informations suivantes:"
    - urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:41.2.a
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:41.2
      ref_id: 41.2.a
      description: 'an introductory section providing:'
      translations:
        fr:
          description: 'une partie introductive contenant:'
    - urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:41.2.a.i
      assessable: true
      depth: 6
      parent_urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:41.2.a
      ref_id: 41.2.a.i
      description: "a description of the context of the report in terms of the nature,\
        \ scale, and complexity of the financial entity's services, activities, and\
        \ operations, the financial entity\u2019s organisation, identified critical\
        \ functions, strategy, major ongoing projects or activities, and relationships,\
        \ and the financial entity\u2019s dependence on in-house and outsourced ICT\
        \ services and systems, or the implications that a total loss or severe degradation\
        \ of such systems would have on critical or important functions and market\n\
        efficiency;"
      translations:
        fr:
          description: "une description du contexte du rapport en ce qui concerne\
            \ la nature, l\u2019\xE9chelle et la complexit\xE9 des services, activit\xE9\
            s et op\xE9rations de l\u2019entit\xE9 financi\xE8re, son organisation,\
            \ ses fonctions critiques recens\xE9es, sa strat\xE9gie, ses grands projets\
            \ ou activit\xE9s en cours, ses relations et sa d\xE9pendance \xE0 l\u2019\
            \xE9gard des services et syst\xE8mes de TIC internes ou sous-trait\xE9\
            s, ou les cons\xE9quences qu\u2019une perte totale ou une d\xE9gradation\
            \ grave de ces syst\xE8mes engendrerait en ce qui concerne les fonctions\
            \ critiques ou importantes et l\u2019efficience du march\xE9;"
    - urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:41.2.a.ii
      assessable: true
      depth: 6
      parent_urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:41.2.a
      ref_id: 41.2.a.ii
      description: an executive level summary of the current and near-term ICT risk
        identified, threat landscape, the assessed effectiveness of its controls,
        and the security posture of the financial entity;
      translations:
        fr:
          description: "une synth\xE8se du risque li\xE9 aux TIC actuel et \xE0 court\
            \ terme qui a \xE9t\xE9 identifi\xE9, de l\u2019\xE9ventail des menaces,\
            \ de l\u2019\xE9valuation de l\u2019efficacit\xE9 de ses contr\xF4les\
            \ et de la posture de s\xE9curit\xE9 de l\u2019entit\xE9 financi\xE8re;"
    - urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:41.2.a.iii
      assessable: true
      depth: 6
      parent_urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:41.2.a
      ref_id: 41.2.a.iii
      description: information about the reported area;
      translations:
        fr:
          description: "des informations sur le domaine faisant l\u2019objet du rapport;"
    - urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:41.2.a.iv
      assessable: true
      depth: 6
      parent_urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:41.2.a
      ref_id: 41.2.a.iv
      description: a summary of the major changes in the ICT risk management framework
        since the previous report;
      translations:
        fr:
          description: "un r\xE9sum\xE9 des changements majeurs dont le cadre de gestion\
            \ du risque li\xE9 aux TIC a fait l\u2019objet depuis le rapport pr\xE9\
            c\xE9dent;"
    - urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:41.2.a.v
      assessable: true
      depth: 6
      parent_urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:41.2.a
      ref_id: 41.2.a.v
      description: a summary and a description of the impact of major changes to the
        simplified ICT risk management framework since the previous report;
      translations:
        fr:
          description: "un r\xE9sum\xE9 et une description de l\u2019incidence des\
            \ changements dont le cadre simplifi\xE9 de gestion du risque li\xE9 aux\
            \ TIC a fait l\u2019objet depuis le rapport pr\xE9c\xE9dent;"
    - urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:41.2.b
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:41.2
      ref_id: 41.2.b
      description: where applicable, the date of the approval of the report by the
        management body of the financial entity;
      translations:
        fr:
          description: "le cas \xE9ch\xE9ant, la date d\u2019approbation du rapport\
            \ par l\u2019organe de direction de l\u2019entit\xE9 financi\xE8re;"
    - urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:41.2.c
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:41.2
      ref_id: 41.2.c
      description: 'a description of the reasons for the review, including:'
      translations:
        fr:
          description: "une description des raisons du r\xE9examen, notamment:"
    - urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:41.2.c.i
      assessable: true
      depth: 6
      parent_urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:41.2.c
      ref_id: 41.2.c.i
      description: where the review has been initiated following supervisory instructions,
        evidence of such instructions;
      translations:
        fr:
          description: "lorsque le r\xE9examen a \xE9t\xE9 engag\xE9 \xE0 la suite\
            \ d\u2019instructions des autorit\xE9s de surveillance, la preuve de ces\
            \ instructions;"
    - urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:41.2.c.ii
      assessable: true
      depth: 6
      parent_urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:41.2.c
      ref_id: 41.2.c.ii
      description: where the review has been initiated following the occurrence of
        ICT-related incidents, the list of all those ICT-related incidents with related
        incident root-cause analysis;
      translations:
        fr:
          description: "lorsque le r\xE9examen a \xE9t\xE9 engag\xE9 \xE0 la suite\
            \ d\u2019incidents li\xE9s aux TIC, la liste de ces incidents accompagn\xE9\
            e d\u2019une analyse de leur cause originelle;"
    - urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:41.2.d
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:41.2
      ref_id: 41.2.d
      description: the start and end date of the review period;
      translations:
        fr:
          description: "les dates de d\xE9but et de fin de la p\xE9riode examin\xE9\
            e;"
    - urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:41.2.e
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:41.2
      ref_id: 41.2.e
      description: the person responsible for the review;
      translations:
        fr:
          description: "la personne responsable du r\xE9examen;"
    - urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:41.2.f
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:41.2
      ref_id: 41.2.f
      description: a summary of findings, and a self-assessment of the severity of
        the weaknesses, deficiencies, and gaps identified in ICT risk management framework
        for the review period, including a detailed analysis thereof;
      translations:
        fr:
          description: "un r\xE9sum\xE9 des constatations et une auto\xE9valuation,\
            \ comprenant une analyse d\xE9taill\xE9e, de la gravit\xE9 des faiblesses,\
            \ des d\xE9faillances et des lacunes identifi\xE9es du cadre de gestion\
            \ du risque li\xE9 aux TIC pour la p\xE9riode examin\xE9e;"
    - urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:41.2.g
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:41.2
      ref_id: 41.2.g
      description: remedying measures identified to address weaknesses, deficiencies,
        and gaps in the simplified ICT risk management framework, and the expected
        date for implementing those measures, including the follow-up on weaknesses,
        deficiencies, and gaps identified in previous reports, where those weaknesses,
        deficiencies, and gaps have not yet been remedied;
      translations:
        fr:
          description: "les mesures d\xE9finies pour rem\xE9dier aux faiblesses, aux\
            \ d\xE9faillances et aux lacunes du cadre simplifi\xE9 de gestion du risque\
            \ li\xE9 aux TIC, ainsi que la date pr\xE9vue pour la mise en \u0153uvre\
            \ de ces mesures, y compris les suites donn\xE9es aux faiblesses, d\xE9\
            faillances et lacunes identifi\xE9es dans les rapports pr\xE9c\xE9dents,\
            \ lorsqu\u2019il n\u2019y a pas encore \xE9t\xE9 rem\xE9di\xE9;"
    - urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:41.2.h
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:41.2
      ref_id: 41.2.h
      description: overall conclusions on the review of the simplified ICT risk management
        framework, including any further planned developments.
      translations:
        fr:
          description: "les conclusions g\xE9n\xE9rales du r\xE9examen du cadre simplifi\xE9\
            \ de gestion du risque li\xE9 aux TIC, y compris les nouvelles \xE9volutions\
            \ pr\xE9vues."
    - urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:title-iv
      assessable: false
      depth: 1
      ref_id: TITLE IV
      description: FINAL PROVISIONS
      translations:
        fr:
          name: TITRE IV
          description: DISPOSITIONS FINALES
    - urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:article-42
      assessable: false
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:title-iv
      ref_id: Article 42
      description: Entry into force
      translations:
        fr:
          description: "Entr\xE9e en vigueur"
    - urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:article-42:1
      assessable: false
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:rts-dora-ict-risk-management:article-42
      description: 'This Regulation shall enter into force on the twentieth day following
        that of its publication in

        the Official Journal of the European Union.

        This Regulation shall be binding in its entirety and directly applicable in
        all Member States.'
      translations:
        fr:
          description: "Le pr\xE9sent r\xE8glement entre en vigueur le vingti\xE8\
            me jour suivant celui de sa publication au Journal officiel de l\u2019\
            Union europ\xE9enne. Le pr\xE9sent r\xE8glement est obligatoire dans tous\
            \ ses \xE9l\xE9ments et directement applicable dans tous les \xC9tats\
            \ membres."
