Latvijas Banka Rules No. 409: Requirements for Digital Operational Resilience for Financial Market Participants Not Subject to Regulation (EU) 2022/2554

Text version

Attention! You are using an outdated web browser version.

To use all the features offered on the website Likumi.lv, we invite you to download the latest version of the browser. We also offer the mobile version of the website – m.likumi.lv.

don't show this notice again

Confirm

We invite you to participate in the user satisfaction survey this week!

Thank you for your opinion!

Show later

LATVIAN REPUBLIC LEGAL ACTS

types

topics

most viewed

newest

LV

EN

to the start

Advanced search

Default values

Advanced search

How to search?

Search by name

search in inflections

search for phrase

Search in text

search in inflections

search for phrase

Issuer

Type

don't search in amendments

Adopted

Enters into force

Document No.

until

until

Published in LV

Lost force

Edition on

until

until

Status:

in force

not yet in force

lost force clear

Authorize in your account

Why authorize or register?

Latvijas Banka Rules No. 409 Riga 2026 January 5

Requirements in the field of digital operational continuity and resilience for financial market participants to whom Regulation (EU) 2022/2554 of the European Parliament and of the Council of 14 December 2022 on digital operational resilience for the financial sector and amending Regulations (EC) No 1060/2009, (EU) No 648/2012, (EU) No 600/2014, (EU) No 909/2014 and (EU) 2016/1011 does not apply

Issued in accordance with Article 6, paragraph 3 of the Law on Digital Operational Resilience of the Financial Market and the Use of Artificial Intelligence

I. General Provisions

1. The Rules determine: 1.1. measures to ensure a documented and comprehensive information and communication technology (hereinafter – ICT) risk management and control system; 1.2. requirements for the security and operational monitoring of ICT systems; 1.3. requirements for ICT systems, the physical environment, procedures, and ICT operations management; 1.4. requirements for ensuring the continuity of critical functions, backup creation, recovery measures, and their testing. 2

2. The Rules apply to: 2.1. alternative investment fund managers, if they meet the criteria set out in Article 6, paragraph 1, point 1 of the Law on Digital Operational Resilience of the Financial Market and the Use of Artificial Intelligence; 2.2. insurance undertakings and reinsurance undertakings that comply with Article 6, paragraph 1, point 2 of the Law on Digital Operational Resilience of the Financial Market and the Use of Artificial Intelligence; 2.3. insurance intermediaries, reinsurance intermediaries, and ancillary insurance intermediaries that are micro-enterprises, small enterprises, or medium-sized enterprises; 2.4. natural and legal persons within the meaning of Article 101, paragraph 7, points 2, 3, 4, 6, 7, 9, 12, 13, 15, and 16 of the Law on the Financial Instrument Market; 2.5. credit unions; 2.6. small private pension funds, where the total number of pension plan participants in their registered pension plans does not exceed 15; 2.7. giro settlement institutions. 3

3. A financial market participant (hereinafter – market participant), when implementing the requirements of these Rules, observes the principle of proportionality and a risk-based approach, taking into account the field of activity, the number of employees, the type of services provided, as well as their complexity and the overall level of ICT usage. 4

4. For market participants referred to in points 2.3, 2.4, and 2.6 of these Rules, only point 12.1, point 13, points 18.3, 18.4, points 26.7 and 26.8, and point 28 of these Rules apply. 5

II. Management and Organization

5. The market participant implements and documents an ICT risk management and control system that ensures effective ICT risk management to achieve a high level of digital operational resilience. 6

6. Within the framework of its ICT risk management and control system, the market participant ensures that its management: 6.1. assumes overall responsibility for ensuring that the ICT risk management and control system allows achieving the objectives set out in the market participant's business strategy in accordance with its risk appetite, and ensures that ICT risk is also taken into account in this context; 6.2. determines all obligations and responsibilities related to ICT usage; 6.3. determines information security objectives and ICT requirements; 6.4. approves, monitors, and periodically reviews: 6.4.1. the classification of the market participant's information assets and ICT assets; 6.4.2. the market participant's business continuity plans, including business impact analysis; 6.5. allocates and reviews at least once a year the budget necessary to meet the market participant's digital operational resilience needs regarding all types of resources, including ICT security awareness programs and ICT usage skills training for all employees; 6.6. determines and implements measures to identify, assess, and manage ICT risks to which the market participant is exposed, including ICT risks related to third parties; 6.7. determines and implements procedures and controls necessary to protect all information assets and ICT assets; 6.8. ensures that the market participant's employees continuously update their knowledge and skills to sufficiently understand and assess ICT risk and its impact on the market participant's operations; 6.9. determines the procedure for reporting to management incidents related to ICT and digital operational resilience, including determining the frequency, format, and content of reports. 7

7. The market participant may entrust ICT service provision to third parties. In such a case, the market participant remains fully responsible for compliance with ICT risk management requirements and for service monitoring. 8

III. Information Security Policy and Measures

8. The market participant develops, documents, and implements an information security policy that defines high-level principles and rules to protect the confidentiality, integrity, and availability of data and provided services. 9

9. Based on the information security policy referred to in point 8 of these Rules, the market participant determines and implements ICT security measures to reduce its exposure to ICT risk, including determining risk mitigation measures implemented by third parties providing ICT services. 10

IV. Classification of Information Assets and ICT Assets

10. As part of the ICT risk management and control system, the market participant identifies, classifies, documents, and as necessary reviews and updates all critical and important functions, the supporting information assets and ICT assets, and their interdependencies. 11

11. The market participant also identifies all critical functions provided by third parties providing ICT services. 12

V. ICT Risk Management

12. The market participant develops, documents, and maintains an ICT risk management and control system that includes at least the following elements: 12.1. ICT risk identification, assessment, and mitigation measures, including for ICT services provided by third parties; 12.2. determination of risk mitigation strategies and monitoring their effectiveness; 12.3. identification and assessment of ICT and information security risks arising from significant changes in ICT systems, ICT services, or processes, or from ICT security testing results, or a significant ICT incident. 13

13. The market participant performs and documents an ICT risk assessment at least once a year. 14

14. The market participant continuously monitors threats and vulnerabilities that are significant with respect to its critical functions, information assets, and ICT assets, and regularly reviews risk scenarios affecting those critical functions. 15

15. The market participant determines the procedure for identifying, registering, and classifying ICT incidents, as well as the procedure for reporting to its management. 16

VI. Physical Security

16. The market participant identifies and implements physical security measures to carefully and adequately protect all information assets and ICT assets, including workstations, computer software and hardware, as well as to protect all relevant physical components and infrastructure, such as premises and data centers. 17

VII. Access Control

17. The market participant develops, implements, monitors, and regularly reviews procedures for logical and physical access control. These procedures include the following elements of logical and physical access control: 17.1. rights regarding access to information assets, ICT assets, and their supported functions, managed in accordance with the principles of "need to know" and "need to use" and the principle of least privilege, also regarding remote and emergency access; 17.2. logging of user and system activities, ensuring that users can be identified with respect to actions performed in ICT systems. The market participant determines an appropriate system log retention period to enable it to identify, register, and report incidents related to ICT, as well as to maintain necessary records for investigation and monitoring purposes; 17.3. user account management procedures to grant, change, or revoke access rights for users and general accounts, including general administrator accounts; 17.4. authentication methods that are proportional to the classification referred to in point 10 of these Rules and the general risk profile of ICT assets and comply with best practices; 17.5. access rights are reviewed periodically, but at least once a year, and revoked immediately when they are no longer necessary. The market participant documents access rights regarding ICT resources and their changes and maintains a corresponding register; 17.6. for the purposes of point 17.4 of these Rules, the market participant uses strong multi-factor authentication methods based on best practices regarding remote access to the market participant's computer network, privileged access, and access to ICT assets supporting critical functions that are publicly available. 18

VIII. ICT Operational Security

18. Within the framework of its ICT risk management and control system and with respect to ICT assets, the market participant: 18.1. monitors and manages the lifecycle of ICT assets; 18.2. where applicable, monitors whether ICT assets are supported by third parties providing ICT services; 18.3. performs automated vulnerability assessment and uses security patches to eliminate identified vulnerabilities; 18.4. manages risks associated with obsolete, unsupported, or legacy ICT assets; 18.5. registers events related to access rights and ICT change management; 18.6. identifies and implements measures to monitor and analyze information about anomalous activities and behavior of ICT systems; 18.7. implements measures to monitor significant and current information about cyber threats. 19

IX. Data, System, and Network Security

19. As part of the ICT risk management and control system, the market participant develops and implements protection measures that ensure network protection against intrusion and unauthorized data use. The market participant determines: 19.1. security measures and ensures their implementation to protect data when they are used, transmitted, or stored; 19.2. security measures and ensures their implementation to prevent and detect unauthorized connection to the market participant's network and to protect network traffic between its internal networks and the internet or other external connections; 19.3. a process for the secure deletion of data no longer needed by the market participant; 19.4. a process to securely dispose of or decommission data storage devices containing confidential information; 19.5. security measures to ensure that remote work and the use of private endpoint devices do not adversely affect the market participant's ability to perform its critical functions. 20

X. ICT Security Testing

20. The market participant develops and implements an ICT security testing plan to assess the effectiveness of its ICT security measures developed in accordance with the requirements of these Rules. The market participant ensures that the testing plan takes into account threats and vulnerabilities identified within the framework of the ICT risk management system. 21

21. The market participant monitors and evaluates ICT security testing results and timely reviews and updates security measures for ICT systems supporting critical functions. 22

XI. Procurement, Development, and Maintenance of ICT Systems

22. In the procurement, development, and maintenance of ICT systems, the market participant applies a risk-based approach, including: 22.1. ensuring that before the procurement or development of ICT systems, the relevant business unit determines and approves functional and non-functional requirements, including information security requirements; 22.2. ensuring testing and approval of ICT systems before their initial use and before implementing changes in the production environment; 22.3. determining measures to mitigate the risk of accidental modification or intentional manipulation of ICT systems during development and implementation in the production environment. 23

XII. ICT Project and Change Management

23. The market participant observes best practices in ICT project management, covering all stages of ICT projects from initiation to closure. 24

24. The market participant develops and implements an ICT change management procedure to ensure that changes to ICT systems are registered, tested, and implemented in a controlled manner and with appropriate protection measures. 25

XIII. ICT Operational Continuity Management

25. The market participant develops and documents a business continuity plan, taking into account business impact results and scenarios to which ICT assets supporting critical functions might be exposed, including cyberattack scenarios. 26

26. ICT operational continuity plans: 26.1. are approved by the market participant's management structure; 26.2. are documented and readily available in case of crisis; 26.3. provide sufficient resources for plan implementation; 26.4. determine planned recovery levels and deadlines for the recovery and restoration of functions, including functions supported by third parties; 26.5. provide conditions for activating ICT operational continuity plans; 26.6. determine recovery measures for critical business functions, support processes, and information assets to avoid adverse impact on the market participant's operations; 26.7. provide backup procedures and measures that determine the scope of data to be backed up and the frequency of backups, based on the importance of the functions using those data; 26.8. take into account alternative options if recovery in the short term is not possible due to costs or unforeseen circumstances; 26.9. determine the procedure for internal and external communication, including escalation plans; 26.10. are updated based on experience gained from incidents, tests, and new risks, as well as significant changes in the market participant's organization and ICT assets supporting critical business functions. 27

XIV. Testing of Business Continuity Plans

27. The market participant tests business continuity plans at least once a year or whenever significant changes occur, taking into account possible scenarios, including cyberattacks. 28

28. The market participant tests backup and recovery procedures at least once a year or whenever significant changes occur in the market participant's business continuity plan. 29

29. The market participant documents the results of business continuity plan testing and analyzes and eliminates deficiencies identified in such testing. 30

XV. Final Provisions

30. The Rules enter into force on 15 January 2026. 31

President of Latvijas Banka M. Kazāks

365659

87

0

With content index

With my notes

With larger font

Print legal act

X

Facebook

Draugiem.lv

"Everyone has the right to know their rights."

Article 90 of the Constitution of the Latvian Republic

© Official Publisher "Latvijas Vēstnesis"