The ICT security policies, information security and the related procedures, protocols and tools under DORA Article 9(2) must sit inside the ICT risk management framework and must secure networks, guard against intrusion and data misuse, protect the availability, authenticity, integrity and confidentiality of data (including by cryptography) and support accurate, timely data transmission. The policies must align with the information security objectives in the digital operational resilience strategy, show the date the management body formally approved them, carry indicators to monitor implementation and to record exceptions while keeping resilience intact when exceptions arise, set staff responsibilities at every level and the consequences of non-compliance, list the documentation to be kept, set segregation of duties under the three lines model or equivalent, draw on leading practice and European standards, name who develops and maintains them, be reviewed under DORA Article 6(5), and be updated for material changes to the business, the threat landscape or the law.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.