If there is a difference between the presentation of the text below and in the PDF document, the PDF document shall prevail.

No. 310/2026
27 March 2026

RULES

on digital operational resilience of the financial market.

Article 1. Scope.

These rules apply to entities in the financial market pursuant to Article 2 of Regulation (EU) 2022/2554, cf. the Act on Digital Operational Resilience of the Financial Market, No. 78/2025, and pension funds pursuant to the Act on Mandatory Insurance of Pension Rights and the Operation of Pension Funds, No. 129/1997, cf. Article 36(g) of that Act.

Article 2. Management of information and communication technology risk, management of risk relating to third parties, handling and notification of incidents and testing of digital operational resilience.

The handling and notification of incidents related to information and communication technology and cyber threats shall be in accordance with Regulations (EU) 2024/1772, 2025/301 and 2025/302, cf. Article 3.

The management of information and communication technology risk shall be in accordance with Regulation (EU) 2024/1774, cf. Article 3.

The use of information and communication technology services provided by third parties shall be in accordance with Regulations (EU) 2024/1773 and 2025/532 on use, cf. Article 3.

The harmonisation of conditions enabling the oversight activities of the European supervisory authorities shall be in accordance with Regulations (EU) 2025/295 and 2025/420, cf. Article 3.

Threat-led penetration testing shall be in accordance with Regulation (EU) 2025/1190, cf. Article 3.

Article 3. Implementation of regulations.

With these rules, the following regulations shall enter into force in this country:

Commission Delegated Regulation (EU) 2024/1772 of 13 March 2024 supplementing Regulation (EU) 2022/2554 of the European Parliament and of the Council with regard to regulatory technical standards specifying the criteria for the classification of ICT-related incidents and cyber threats, setting out materiality thresholds and specifying the details of reports of major incidents, which was incorporated into the EEA Agreement by Decision of the EEA Joint Committee No. 77/2025 of 14 March 2025, published in the EEA Supplement to the Official Journal of the European Union No. 38 of 12 June 2025, p. 58. The Regulation is published in Annex 1 to these rules.
Commission Delegated Regulation (EU) 2024/1773 of 13 March 2024 supplementing Regulation (EU) 2022/2554 of the European Parliament and of the Council with regard to regulatory technical standards specifying the detailed content of the policy regarding contractual arrangements on the use of ICT services supporting critical or important functions provided by ICT third-party service providers, which was incorporated into the EEA Agreement by Decision of the EEA Joint Committee No. 77/2025 of 14 March 2025, published in the EEA Supplement to the Official Journal of the European Union No. 38 of 12 June 2025, p. 58. The Regulation is published in Annex 2 to these rules.
Commission Delegated Regulation (EU) 2024/1774 of 13 March 2024 supplementing Regulation (EU) 2022/2554 of the European Parliament and of the Council with regard to regulatory technical standards specifying ICT risk management tools, methods, processes and policies and the simplified ICT risk management framework, which was incorporated into the EEA Agreement by Decision of the EEA Joint Committee No. 77/2025 of 14 March 2025, published in the EEA Supplement to the Official Journal of the European Union No. 38 of 12 June 2025, p. 58. The Regulation is published in Annex 3 to these rules.
Commission Delegated Regulation (EU) 2025/295 of 24 October 2024 supplementing Regulation (EU) 2022/2554 of the European Parliament and of the Council with regard to regulatory technical standards on the harmonisation of conditions enabling the conduct of the oversight activities, which was incorporated into the EEA Agreement by Decision of the EEA Joint Committee No. 137/2025 of 13 June 2025, published in the EEA Supplement to the Official Journal of the European Union No. 61 of 2 October 2025, p. 40. The Regulation is published in Annex 4 to these rules.
Commission Delegated Regulation (EU) 2025/301 of 23 October 2024 supplementing Regulation (EU) 2022/2554 of the European Parliament and of the Council with regard to regulatory technical standards specifying the content and time limits for the initial notification of, and intermediate and final reports on, major ICT-related incidents, and the content of the voluntary notification for significant cyber threats, which was incorporated into the EEA Agreement by Decision of the EEA Joint Committee No. 137/2025 of 13 June 2025, published in the EEA Supplement to the Official Journal of the European Union No. 61 of 2 October 2025, p. 40. The Regulation is published in Annex 5 to these rules.
Commission Implementing Regulation (EU) 2025/302 of 23 October 2024 laying down implementing technical standards for the application of Regulation (EU) 2022/2554 of the European Parliament and of the Council with regard to the standard forms, templates and procedures for financial entities to report major ICT-related incidents and to notify significant cyber threats, which was incorporated into the EEA Agreement by Decision of the EEA Joint Committee No. 36/2026 of 6 February 2026. The Regulation is published in Annex 6 to these rules.
Commission Delegated Regulation (EU) 2025/420 of 16 December 2024 supplementing Regulation (EU) 2022/2554 of the European Parliament and of the Council with regard to regulatory technical standards to further specify the criteria for determining the composition of the joint examination team to ensure a balanced participation of staff members from the European supervisory authorities and from the relevant competent authorities, their designation, tasks and working arrangements, which was incorporated into the EEA Agreement by Decision of the EEA Joint Committee No. 299/2025 of 5 December 2025, published in Annex 7 to these rules, with the adaptations resulting from the Decision of the EEA Joint Committee. The Regulation is published in Annex 8 to these rules.
Commission Delegated Regulation (EU) 2025/532 of 24 March 2025 supplementing Regulation (EU) 2022/2554 of the European Parliament and of the Council with regard to regulatory technical standards specifying the elements that a financial entity has to determine and assess when subcontracting ICT services supporting critical or important functions, as incorporated into the EEA Agreement by Decision of the EEA Joint Committee No 299/2025 of 5 December 2025. The Regulation is published in Annex 9 to these rules.
Commission Delegated Regulation (EU) 2025/1190 of 13 February 2025 supplementing Regulation (EU) 2022/2554 of the European Parliament and of the Council with regard to regulatory technical standards specifying the criteria used to identify financial entities required to perform threat-led penetration testing, the requirements and standards applicable to the use of internal testers, the requirements concerning the scope, testing methodologies and approach for each phase of testing, the results, closure and remediation stages of testing and the type of supervisory and other relevant cooperation required for the implementation of threat-led penetration testing and to facilitate mutual recognition, as incorporated into the EEA Agreement by Decision of the EEA Joint Committee No 299/2025 of 5 December 2025. The Regulation is published in Annex 10 to these rules.

Article 4. Entry into force.

These rules, laid down pursuant to the authority in the first to eighth points of the second paragraph of Article 11 of the Act on Digital Operational Resilience for the Financial Market No. 78/2025 and the sixth paragraph of Article 36 g of the Act on Mandatory Insurance of Pension Rights and the Activities of Pension Funds, No. 129/1997, enter into force immediately.

Central Bank of Iceland, 27 March 2026.
Björk Sigurgísladóttir
Deputy Governor of Financial Supervision.
Guðmundur Óli Blöndal
Director.