Latvijas Banka Rules No. 409 on Requirements for Digital Operational Resilience for Financial Market Participants Not Subject to Regulation (EU) 2022/2554

Text version

Attention! You are using an outdated web browser version.

To use all the features offered on Likumi.lv, we invite you to download the latest browser version. We also offer the mobile version of the site – m.likumi.lv.

don't show this message again

Confirm

We invite you to participate in the user satisfaction survey this week!

Thank you for your opinion!

Show later

LATVIAN REPUBLIC LEGAL ACTS

types

topics

most viewed

newest

to the beginning

Advanced search

Default values

Advanced search

How to search?

Search by name

search in inflections

search for phrase

Search in text

search in inflections

search for phrase

Issuer

Type

don't search in amendments

Adopted

Enters into force

Document No.

until

Published in LV

Lost force

Edition on

until

Status:

in force

not yet in force

lost force clear

Authorize in your account

Why authorize or register?

Latvijas Banka Rules No. 409 Riga 2026 January 5

Requirements in the field of digital operational continuity and resilience for financial market participants to whom Regulation (EU) 2022/2554 of the European Parliament and of the Council of 14 December 2022 on digital operational resilience for the financial sector and amending Regulations (EC) No 1060/2009, (EU) No 648/2012, (EU) No 600/2014, (EU) No 909/2014 and (EU) 2016/1011 does not apply

Issued in accordance with Article 6, paragraph three of the Law on Digital Operational Resilience of the Financial Market and the Use of Artificial Intelligence

I. General Provisions

These Rules establish:
1.1. measures to ensure a documented and comprehensive information and communication technology (hereinafter – ICT) risk management and control system;
1.2. requirements for the security and operational monitoring of ICT systems;
1.3. requirements for ICT systems, the physical environment, procedures, and ICT operations management;
1.4. requirements for ensuring the continuity of critical functions, backup creation, recovery measures, and their testing.
These Rules apply to:
2.1. alternative investment fund managers, if they meet the criteria set out in Article 6, paragraph one, point 1 of the Law on Digital Operational Resilience of the Financial Market and the Use of Artificial Intelligence;
2.2. insurance companies and reinsurance companies, which comply with the requirements set out in Article 6, paragraph one, point 2 of the Law on Digital Operational Resilience of the Financial Market and the Use of Artificial Intelligence;
2.3. insurance intermediaries, reinsurance intermediaries, and ancillary insurance service intermediaries, which are micro-enterprises, small enterprises, or medium-sized enterprises;
2.4. natural and legal persons within the meaning of Article 101, paragraph seven, points 2, 3, 4, 6, 7, 9, 12, 13, 15, and 16 of the Law on Financial Instruments Markets;
2.5. credit unions;
2.6. small private pension funds, in which the total number of pension plan participants in registered pension plans does not exceed 15;
2.7. giro settlement institutions.
A financial market participant (hereinafter – market participant), implementing the requirements of these Rules, observes the principle of proportionality and a risk-based approach, taking into account the area of activity, number of employees, type of services provided, as well as their complexity and overall level of ICT usage.
For market participants referred to in points 2.3, 2.4, and 2.6 of these Rules, only point 12.1, point 13, points 18.3, 18.4, points 26.7 and 26.8, and point 28 of these Rules apply.

II. Management and Organization

The market participant implements and documents an ICT risk management and control system that ensures effective ICT risk management to achieve a high level of digital operational resilience.
Within the framework of its ICT risk management and control system, the market participant ensures that its management:
6.1. assumes overall responsibility for ensuring that the ICT risk management and control system allows achieving the objectives set in the market participant's business strategy in accordance with its risk appetite, and ensures that ICT risk is also taken into account in this context;
6.2. defines all obligations and responsibilities related to ICT usage;
6.3. defines information security objectives and ICT requirements;
6.4. approves, monitors, and periodically reviews:
6.4.1. the classification of the market participant's information assets and ICT assets;
6.4.2. the market participant's business continuity plans, including business impact analysis;
6.5. allocates and reviews at least once a year the budget necessary to meet the market participant's digital operational resilience needs regarding all types of resources, including ICT security awareness programs and ICT usage skills training for all employees;
6.6. defines and implements measures to identify, assess, and manage ICT risks to which the market participant is exposed, including ICT risks related to third parties;
6.7. defines and implements procedures and controls necessary to protect all information assets and ICT assets;
6.8. ensures that the market participant's employees continuously update knowledge and skills that allow adequately understanding and assessing ICT risk and its impact on the market participant's operations;
6.9. defines the procedure for reporting to management incidents related to ICT and digital operational resilience, including defining the frequency, format, and content of reports.
The market participant may entrust ICT service provision to third parties. In such a case, the market participant remains fully responsible for compliance with ICT risk management requirements and service monitoring.

III. Information Security Policy and Measures

The market participant develops, documents, and implements an information security policy that defines high-level principles and rules to protect the confidentiality, integrity, and availability of data and provided services.
Based on the information security policy referred to in point 8 of these Rules, the market participant defines and implements ICT security measures to reduce its exposure to ICT risk, including defining risk reduction measures implemented by third parties providing ICT services.

IV. Classification of Information Assets and ICT Assets

As part of the ICT risk management and control system, the market participant identifies, classifies, documents, and as necessary reviews and updates all critical and important functions, the information assets and ICT assets supporting them, and their interdependencies.
The market participant also identifies all critical functions provided by third parties providing ICT services.

V. ICT Risk Management

The market participant develops, documents, and maintains an ICT risk management and control system that includes at least the following elements:
12.1. ICT risk identification, assessment, and risk reduction measures, including for ICT services provided by third parties;
12.2. defining risk reduction strategies and monitoring their effectiveness;
12.3. identification and assessment of ICT and information security risks arising from significant changes in ICT systems, ICT services, or processes, or from ICT security testing results, or a significant ICT incident.
The market participant performs and documents an ICT risk assessment at least once a year.
The market participant continuously monitors threats and vulnerabilities that are significant with respect to its critical functions, information assets, and ICT assets, and regularly reviews risk scenarios affecting those critical functions.
The market participant defines the procedure for identifying, registering, and classifying ICT incidents, as well as the procedure for reporting to its management.

VI. Physical Security

The market participant identifies and implements physical security measures to carefully and adequately protect all information assets and ICT assets, including workstations, computer software and hardware, as well as to protect all relevant physical components and infrastructure, such as premises and data centers.

VII. Access Control

The market participant develops, implements, monitors, and regularly reviews procedures for logical and physical access control. These procedures include the following elements of logical and physical access control:
17.1. rights regarding access to information assets, ICT assets, and the functions they support, managed in accordance with the principles of "need to know" and "need to use" and the principle of least privilege, also regarding remote and emergency access;
17.2. logging of user and system activities, ensuring that users can be identified with respect to actions performed in ICT systems. The market participant defines an appropriate system log retention period to enable identification, registration, and reporting of ICT-related incidents, as well as maintaining necessary records for investigation and monitoring purposes;
17.3. user account management procedures to grant, change, or revoke access rights for users and general accounts, including general administrator accounts;
17.4. authentication methods that are proportional to the classification referred to in point 10 of these Rules and the overall risk profile of ICT assets and comply with best practice;
17.5. access rights are reviewed periodically, but at least once a year, and revoked immediately when no longer needed. The market participant documents access rights to ICT resources and their changes and maintains an appropriate register;
17.6. for the purposes of point 17.4 of these Rules, the market participant uses strong multi-factor authentication methods based on best practice regarding remote access to the market participant's computer network, privileged access, and access to ICT assets supporting critical functions that are publicly available.

VIII. ICT Operational Security

Within the framework of its ICT risk management and control system and with respect to ICT assets, the market participant:
18.1. monitors and manages the lifecycle of ICT assets;
18.2. where appropriate, monitors whether ICT assets are supported by third parties providing ICT services;
18.3. performs automated vulnerability assessment and uses security patches to eliminate identified vulnerabilities;
18.4. manages risks associated with obsolete, unsupported, or legacy ICT assets;
18.5. registers events related to access rights and ICT change management;
18.6. identifies and implements measures to monitor and analyze information about anomalous activities and behavior of ICT systems;
18.7. implements measures to monitor significant and current information about cyber threats.

IX. Data, System, and Network Security

As part of the ICT risk management and control system, the market participant develops and implements protection measures that ensure network protection against intrusion and unauthorized data use. The market participant defines:
19.1. security measures and ensures their implementation to protect data when it is used, sent, or stored;
19.2. security measures and ensures their implementation to prevent and detect unauthorized connection to the market participant's network and to protect network traffic between its internal networks and the internet or other external connections;
19.3. a process for the secure deletion of data no longer needed by the market participant;
19.4. a process to securely dispose of or decommission data storage devices containing confidential information;
19.5. security measures to ensure that remote work and the use of private endpoint devices do not adversely affect the market participant's ability to perform its critical functions.

X. ICT Security Testing

The market participant develops and implements an ICT security testing plan to evaluate the effectiveness of its ICT security measures developed in accordance with the requirements of these Rules. The market participant ensures that the testing plan takes into account threats and vulnerabilities identified within the ICT risk management system.
The market participant monitors and evaluates ICT security testing results and timely reviews and updates security measures for ICT systems supporting critical functions.

XI. Procurement, Development, and Maintenance of ICT Systems

In the procurement, development, and maintenance of ICT systems, the market participant applies a risk-based approach, including:
22.1. ensuring that the relevant business unit defines and approves functional and non-functional requirements, including information security requirements, before the procurement or development of ICT systems;
22.2. ensuring testing and approval of ICT systems before their initial use and before implementing changes in the production environment;
22.3. defining measures to reduce the risk of accidental modification or intentional manipulation of ICT systems during development and implementation in the production environment.

XII. ICT Project and Change Management

The market participant observes best practices in ICT project management, covering all stages of ICT projects from initiation to closure.
The market participant develops and implements an ICT change management procedure to ensure that changes to ICT systems are registered, tested, and implemented in a controlled manner and with appropriate protection measures.

XIII. ICT Operational Continuity Management

The market participant develops and documents a business continuity plan, taking into account business impact results and scenarios to which ICT assets supporting critical functions might be exposed, including cyberattack scenarios.
ICT operational continuity plans:
26.1. are approved within the market participant's management structure;
26.2. are documented and readily available in case of crisis;
26.3. provide sufficient resources for plan execution;
26.4. define planned recovery levels and deadlines for the recovery and restoration of functions, including functions supported by third parties;
26.5. define conditions for activating ICT operational continuity plans;
26.6. define recovery measures for critical business functions, support processes, and information assets to avoid adverse impact on the market participant's operations;
26.7. define backup procedures and measures that specify the scope of data to be backed up and the frequency of backups, based on the importance of the functions using these data;
26.8. take into account alternative options if short-term recovery is not possible due to costs or unforeseen circumstances;
26.9. define internal and external communication procedures, including escalation plans;
26.10. are updated based on experience gained from incidents, tests, and new risks, as well as significant changes in the market participant's organization and ICT assets supporting critical business functions.

XIV. Testing of Business Continuity Plans

The market participant tests business continuity plans at least once a year or whenever significant changes occur, taking into account possible scenarios, including cyberattacks.
The market participant tests backup and recovery procedures at least once a year or whenever significant changes occur in the market participant's business continuity plan.
The market participant documents the results of business continuity plan testing and analyzes and eliminates deficiencies identified in such testing.

XV. Final Provisions