Duty LXD-8002
Is a payment provider, in Iceland
Digital Operational Resilience of the Financial Market: ICT-Related Incident Management and Reportingsince 4 lines
Log nr. 78/2025 um stafrænan viðnámsþrótt fjármálamarkaðar, Art. 1, 3 and 5 (Regulation (EU) 2022/2554, Arts. 17 to 19) · Read the law's page
- Applies to the financial entities within Regulation (EU) 2022/2554 (DORA), which Article 1 of Act 78/2025 gives the force of law in Iceland, other than Byggðastofnun, Lánasjóður sveitarfélaga and Náttúruhamfaratrygging Íslands (Article 12). Reached by declaring that you provide financial services.
- Put in place the ICT-related incident management process that Article 17 of Regulation (EU) 2022/2554 requires (Act 78/2025, Article 5, item 3).
- Classify ICT-related incidents and cyber threats as paragraphs 1 and 2 of Article 18 of the Regulation require (Act 78/2025, Article 5, item 4).
- Report serious ICT-related incidents as paragraphs 1, 3 and 4 of Article 19 of the Regulation require (Act 78/2025, Article 5, item 5).
Digital Operational Resilience of the Financial Market: ICT Risk Management and Testingsince 4 lines
Log nr. 78/2025 um stafrænan viðnámsþrótt fjármálamarkaðar, Art. 1, 3 and 5 (Regulation (EU) 2022/2554, Arts. 5 to 16 and 24 to 30) · Read the law's page
- Applies to the financial entities within Regulation (EU) 2022/2554 (DORA), which Article 1 of Act 78/2025 gives the force of law in Iceland, other than Byggðastofnun, Lánasjóður sveitarfélaga and Náttúruhamfaratrygging Íslands (Article 12). Reached by declaring that you provide financial services.
- Meet the ICT risk management requirements of Articles 5 to 14 of Regulation (EU) 2022/2554, or the simplified ICT risk management framework of Article 16 where it applies to you (Act 78/2025, Article 5, items 1 and 2).
- Meet the Regulation's requirements on digital operational resilience testing, including the testing of ICT tools and systems and, where required, threat-led penetration testing (Articles 24 to 27 of the Regulation, Act 78/2025, Article 5, items 6 to 9).
- Manage ICT third-party risk as Articles 28 to 30 of the Regulation require, including the contractual provisions on ICT third-party service providers (Act 78/2025, Article 5, items 10 and 11).