EIOPA Guidelines on ICT Security and Governance (EIOPA-BoS-20/600)

European Union (EIOPA)

v2023

5 domains

25 controls

EIOPA Guidelines (EIOPA-BoS-20/600, issued 12 October 2020, applied from 1 July 2021) on how insurance and reinsurance undertakings should apply the Solvency II governance requirements (Directive 2009/138/EC and Delegated Regulation (EU) 2015/35) to information and communication technology (ICT) security and governance. 25 guidelines covering ICT governance and strategy, ICT and security risk management, information security, ICT operations and change management, business continuity, and outsourcing of ICT services. WITHDRAWN from 17 January 2025, superseded by the Digital Operational Resilience Act (DORA, Regulation (EU) 2022/2554) for EU financial entities.

Verified

Framework summaries on this platform are AI-assisted interpretations for educational and compliance planning purposes. They do not reproduce or replace the official standards. Refer to the authoritative source for the definitive text. Framework names and trademarks belong to their respective organisations.

Framework Domains (5)

EIOPA ICT - Business Continuity Management

6 controls

Controls in the EIOPA ICT - Business Continuity Management domain of EIOPA Guidelines on ICT Security and Governance (EIOPA-BoS-20/600) — 6 controls
Code	Title	Description
EIOPA-ICTSG-GL.19	Business continuity management	As part of the overall business continuity policy, the AMSB sets and approves the ICT continuity policy, communicated ap...
EIOPA-ICTSG-GL.20	Business impact analysis	Undertakings conduct a business impact analysis assessing exposure to severe business disruptions and their quantitative...
EIOPA-ICTSG-GL.21	Business continuity planning	Business continuity plans should consider material risks to ICT systems/services and support protection and re-establish...
EIOPA-ICTSG-GL.22	Response and recovery plans	Based on the BIA and plausible scenarios, undertakings develop response and recovery plans specifying activation conditi...
EIOPA-ICTSG-GL.23	Testing of plans	Undertakings test their BCPs and the operation of critical processes/functions/assets and interdependencies (including p...
EIOPA-ICTSG-GL.24	Crisis communications	In a disruption or emergency and during BCP implementation, undertakings should have effective crisis communication meas...

EIOPA ICT - Governance and Risk Management

5 controls

Controls in the EIOPA ICT - Governance and Risk Management domain of EIOPA Guidelines on ICT Security and Governance (EIOPA-BoS-20/600) — 5 controls
Code	Title	Description
EIOPA-ICTSG-GL.1	Proportionality	Undertakings should apply the Guidelines in a manner proportionate to the nature, scale and complexity of the risks inhe...
EIOPA-ICTSG-GL.2	ICT within the system of governance	The administrative, management or supervisory body (AMSB) should ensure the system of governance, in particular risk man...
EIOPA-ICTSG-GL.3	ICT strategy	The AMSB sets and approves a written ICT strategy aligned with business strategy, defining how ICT evolves to support th...
EIOPA-ICTSG-GL.4	ICT and security risks within the risk management system	The AMSB establishes an effective system for managing ICT and security risks within the overall risk management system,...
EIOPA-ICTSG-GL.5	Audit	Governance, systems and processes for ICT and security risks should be audited periodically, in line with the audit plan...

EIOPA ICT - ICT Operations and Change Management

5 controls

Controls in the EIOPA ICT - ICT Operations and Change Management domain of EIOPA Guidelines on ICT Security and Governance (EIOPA-BoS-20/600) — 5 controls
Code	Title	Description
EIOPA-ICTSG-GL.14	ICT operations management	Undertakings manage ICT operations based on the ICT strategy, documenting critical processes/procedures; implement loggi...
EIOPA-ICTSG-GL.15	ICT incident and problem management	Undertakings establish an incident and problem management process to monitor and log operational/security incidents and...
EIOPA-ICTSG-GL.16	ICT project management	Undertakings implement an ICT project methodology (with independent security requirement consideration) and governance t...
EIOPA-ICTSG-GL.17	ICT systems acquisition and development	Undertakings implement a risk-based process governing ICT systems acquisition, development and maintenance ensuring CIA...
EIOPA-ICTSG-GL.18	ICT change management	Undertakings establish an ICT change management process so all changes are recorded, assessed, tested, approved, authori...

EIOPA ICT - Information Security

8 controls

Controls in the EIOPA ICT - Information Security domain of EIOPA Guidelines on ICT Security and Governance (EIOPA-BoS-20/600) — 8 controls
Code	Title	Description
EIOPA-ICTSG-GL.10	ICT operations security	Undertakings implement procedures ensuring CIA of ICT systems and services: vulnerability identification and remediation...
EIOPA-ICTSG-GL.11	Security monitoring	Undertakings establish procedures to continuously monitor activities impacting information security (internal/external f...
EIOPA-ICTSG-GL.12	Information security reviews, assessment and testing	Undertakings perform varied information security reviews/assessments/testing to identify vulnerabilities, establish an i...
EIOPA-ICTSG-GL.13	Information security training and awareness	Undertakings establish information security training programmes for all staff (including the AMSB) to reduce human error...
EIOPA-ICTSG-GL.6	Information security policy and measures	Undertakings establish a written, AMSB-approved information security policy defining principles and rules to protect con...
EIOPA-ICTSG-GL.7	Information security function	Undertakings establish an information security function with responsibilities assigned to a designated person, independe...
EIOPA-ICTSG-GL.8	Logical security	Undertakings define, document and implement logical access control (identity and access management): need-to-know, least...
EIOPA-ICTSG-GL.9	Physical security	Undertakings define, document and implement physical security measures (against power failure, fire, water, unauthorised...

EIOPA ICT - Outsourcing of ICT Services

1 controls

Controls in the EIOPA ICT - Outsourcing of ICT Services domain of EIOPA Guidelines on ICT Security and Governance (EIOPA-BoS-20/600) — 1 controls
Code	Title	Description
EIOPA-ICTSG-GL.25	Outsourcing of ICT services and ICT systems	Without prejudice to the EIOPA cloud-outsourcing guidelines, where ICT services/systems are outsourced undertakings ensu...

Maps to 2 other frameworks

25 total controls

DORA

15 source controls mapped|12 target controls covered

60%

NIST Cybersecurity Framework 2.0

4 source controls mapped|4 target controls covered

16%

Compare EIOPA Guidelines on ICT Security and Governance (EIOPA-BoS-20/600) with DORA

Frequently Asked Questions

What is EIOPA Guidelines on ICT Security and Governance (EIOPA-BoS-20/600)?

EIOPA Guidelines on ICT Security and Governance (EIOPA-BoS-20/600) is a compliance framework from European Union (EIOPA) with 5 domains and 25 controls. EIOPA Guidelines (EIOPA-BoS-20/600, issued 12 October 2020, applied from 1 July 2021) on how insurance and reinsurance undertakings should apply the Solvency II governance requirements (Directive 2009/138/EC and Delegated Regulation (EU) 2015/35) to information and communication technology (ICT) security and governance. 25 guidelines covering ICT governance and strategy, ICT and security risk management, information security, ICT operations and change management, business continuity, and outsourcing of ICT services. WITHDRAWN from 17 January 2025, superseded by the Digital Operational Resilience Act (DORA, Regulation (EU) 2022/2554) for EU financial entities. It is used by organisations to establish and maintain compliance with industry standards and regulatory requirements.

How many controls does EIOPA Guidelines on ICT Security and Governance (EIOPA-BoS-20/600) have?

EIOPA Guidelines on ICT Security and Governance (EIOPA-BoS-20/600) has 25 controls organised across 5 domains. The largest domains are EIOPA ICT - Information Security (8 controls), EIOPA ICT - Business Continuity Management (6 controls), EIOPA ICT - Governance and Risk Management (5 controls). Each control defines specific requirements that organisations must implement to achieve compliance.

What frameworks does EIOPA Guidelines on ICT Security and Governance (EIOPA-BoS-20/600) map to?

EIOPA Guidelines on ICT Security and Governance (EIOPA-BoS-20/600) maps to 2 other compliance frameworks. The top mapping partners are DORA (60% coverage), NIST Cybersecurity Framework 2.0 (16% coverage). Use our comparison tool to explore control-level mappings between frameworks.

How do I get started with EIOPA Guidelines on ICT Security and Governance (EIOPA-BoS-20/600) compliance?

Start your EIOPA Guidelines on ICT Security and Governance (EIOPA-BoS-20/600) compliance journey by running a self-assessment on our platform to identify your current compliance posture. Our AI advisory can answer specific questions about EIOPA Guidelines on ICT Security and Governance (EIOPA-BoS-20/600) requirements, and cross-framework mapping helps you leverage existing controls from other frameworks you may already comply with. Create a free account to access all 25 controls and track your progress.

Start Your Compliance Journey

Create a free account to run self-assessments, get AI advisory, and track your compliance progress across 700 frameworks.

Get Started Free →

Free forever — no credit card required