Duty LXD-6938
Provides financial services, in Iceland
Minimum Risk-Management and Preparedness Requirements for Critical Infrastructuresince 2 lines
Log nr. 78/2019, Art. 7 · Read the law's page
- Maintain a documented security policy and risk-management process, assess and re-assess risk on a regular basis, and put in place technical and organisational security measures, including access control, tested regularly against current international best practice.
- Maintain a documented incident-response plan and a business-continuity plan covering incident logging, root-cause analysis, restoration of normal operation, and prevention of recurrence, and operate an active internal-control system consistent with this Act and any sector-specific law.
- This duty binds an operator of essential services in Iceland's digital-infrastructure sector (an internet exchange point, a domain-name-system service provider, or a top-level domain registry) and a provider of digital services operating an online marketplace, an online search engine, or a cloud computing service, other than a micro-enterprise; it also binds an operator of essential services in banking and financial-market infrastructure, transport, health services, or energy, heating and water utilities, reached by declaring that you operate an essential service.
- A breach of this duty draws an administrative fine of up to ISK 10,000,000, capped at 3 percent of turnover for a legal entity, and, if committed intentionally, imprisonment for up to two years.
Digital Operational Resilience of the Financial Market: ICT-Related Incident Management and Reportingsince 4 lines
Log nr. 78/2025 um stafrænan viðnámsþrótt fjármálamarkaðar, Art. 1, 3 and 5 (Regulation (EU) 2022/2554, Arts. 17 to 19) · Read the law's page
- Applies to the financial entities within Regulation (EU) 2022/2554 (DORA), which Article 1 of Act 78/2025 gives the force of law in Iceland, other than Byggðastofnun, Lánasjóður sveitarfélaga and Náttúruhamfaratrygging Íslands (Article 12). Reached by declaring that you provide financial services.
- Put in place the ICT-related incident management process that Article 17 of Regulation (EU) 2022/2554 requires (Act 78/2025, Article 5, item 3).
- Classify ICT-related incidents and cyber threats as paragraphs 1 and 2 of Article 18 of the Regulation require (Act 78/2025, Article 5, item 4).
- Report serious ICT-related incidents as paragraphs 1, 3 and 4 of Article 19 of the Regulation require (Act 78/2025, Article 5, item 5).
Digital Operational Resilience of the Financial Market: ICT Risk Management and Testingsince 4 lines
Log nr. 78/2025 um stafrænan viðnámsþrótt fjármálamarkaðar, Art. 1, 3 and 5 (Regulation (EU) 2022/2554, Arts. 5 to 16 and 24 to 30) · Read the law's page
- Applies to the financial entities within Regulation (EU) 2022/2554 (DORA), which Article 1 of Act 78/2025 gives the force of law in Iceland, other than Byggðastofnun, Lánasjóður sveitarfélaga and Náttúruhamfaratrygging Íslands (Article 12). Reached by declaring that you provide financial services.
- Meet the ICT risk management requirements of Articles 5 to 14 of Regulation (EU) 2022/2554, or the simplified ICT risk management framework of Article 16 where it applies to you (Act 78/2025, Article 5, items 1 and 2).
- Meet the Regulation's requirements on digital operational resilience testing, including the testing of ICT tools and systems and, where required, threat-led penetration testing (Articles 24 to 27 of the Regulation, Act 78/2025, Article 5, items 6 to 9).
- Manage ICT third-party risk as Articles 28 to 30 of the Regulation require, including the contractual provisions on ICT third-party service providers (Act 78/2025, Article 5, items 10 and 11).