Frameworks · European Union
DORA Art. 9(4)(e) asks that every ICT change is recorded, tested, assessed, approved, implemented and verified. RTS 2024/1774 Art. 17 adds independent approvers and emergency changes approved after the event. Those are the steps of an Aspian change record.
- Instrument
- Regulation (EU) 2022/2554 on digital operational resilience for the financial sector (DORA); Commission Delegated Regulation (EU) 2024/1774 (RTS specifying ICT risk management tools, methods, processes and policies and the simplified ICT risk management framework)
- In force
- DORA applies from 17 January 2025 (Art. 64). RTS 2024/1774 published in the OJ on 25 June 2024, in force 20 days later, applying alongside DORA from 17 January 2025
- For
- EU banks, payment and e-money institutions, investment firms, insurers and their ICT providers.
| Clause | What it requires | Evidenced by |
|---|---|---|
| DORA Art. 9(4)(e) | Risk-based, documented ICT change management so every change to ICT systems is recorded, tested, assessed, approved, implemented and verified in a controlled way.Source: eur-lex.europa.eu | The change record carries each step Art. 9(4)(e) names: recorded, tested, risk-assessed, approved by passkey, deployed and verified by the live version. |
| DORA Art. 28(3) and Art. 30(2)-(3) | Keep a register of all ICT third-party contracts, with mandatory contract terms; contracts for critical or important functions add audit rights, TLPT participation and exit strategies.Source: eur-lex.europa.eu | The supplier register, exportable as your register of information, with contract clause templates for counsel and an exit and handover plan per engagement. |
| DORA Art. 19(4) | For major ICT incidents, send the regulator an initial notification, then an intermediate report, then a final report once root-cause analysis is complete.Source: eur-lex.europa.eu | Incident records linked to the changes that caused them, with the timeline your initial, intermediate and final reports draw on. |
| RTS 2024/1774 Art. 17(1)(b), (f), (g) | Those approving changes must be independent of those requesting and implementing them; emergency changes need safeguards and must be re-evaluated and approved after implementation.Source: eur-lex.europa.eu | Approver independence enforced, not just recorded: the requester and the implementer can never approve. Emergency changes can’t close until their retrospective approval exists. |
Clause references and requirements were read on 8 November 2026 from the official text. Aspian Cloud evidences these clauses; it doesn’t make you compliant, and your assessor decides.
Want the mapping for a framework we don’t list? Ask us. A new framework is a data file, not a code change.
See what shipped without approval in your last 90 days.
Install the GitHub App and the scan arrives in minutes: every repo scored, every unreviewed merge and unapproved deploy named. Nothing is blocked until you choose.
Ship like a startup. Prove it like a bank.