[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"framework:dora\u002F9":3},{"item":4,"lessons":16,"controls":67,"related":97},{"family":5,"item":6,"code":7,"title":8,"citations":9,"publisher":10,"summary_md":11,"official_text":12,"official_attribution":12,"official_url":13,"link_label":14,"note":12,"updated_at":15},"dora","9","Article 9","Protection and prevention",1,"Regulation (EU) 2022\u002F2554 (Digital Operational Resilience Act)","**What it asks for.** Article 9 requires financial entities to continuously monitor and control the security and functioning of ICT systems and to use appropriate security tools, policies and procedures to minimise the impact of ICT risk. It covers information security policies, network management, access control, strong authentication, patching and change management.\n\n**In practice.** The entity maintains information security policies, segments networks, restricts access on a need to know basis, uses strong authentication, protects data in transit and at rest, and runs documented patch and change management. Controls are monitored for effectiveness. Evidence includes policies, network design documents, access reviews, change records and patch reports.\n\n**Common gaps.** Change management often has gaps for cloud and emergency changes. Strong authentication may not extend to all privileged or third party access.",null,"https:\u002F\u002Feur-lex.europa.eu\u002Flegal-content\u002FEN\u002FTXT\u002FHTML\u002F?uri=CELEX:32022R2554#art_9","Read the official text on EUR-Lex","2026-10-18T15:18:43.664+00:00",{"total":17,"list":18},107,[19,23,27,31,35,39,43,47,51,55,59,63],{"slug":20,"title":21,"published_at":22},"ai-assisted-formal-verification-strengthens-cryptographic-protocol-security","AI-Assisted Formal Verification Strengthens Cryptographic Protocol Security","2026-11-10T12:20:24.338+00:00",{"slug":24,"title":25,"published_at":26},"north-korean-hackers-use-fake-meme-coins-to-launder-64b-binance-hack-proceeds","North Korean Hackers Use Fake Meme Coins to Launder $6.4B Binance Hack Proceeds","2026-11-10T09:22:29.583+00:00",{"slug":28,"title":29,"published_at":30},"ai-formally-verifies-signal-protocol-security-highlighting-value-of-cryptographic-validation","AI Formally Verifies Signal Protocol Security, Highlighting Value of Cryptographic Validation","2026-11-10T06:21:04.081+00:00",{"slug":32,"title":33,"published_at":34},"ai-powered-bug-detection-enters-enterprise-security-via-cisco-and-ibm","AI-Powered Bug Detection Enters Enterprise Security via Cisco and IBM","2026-11-10T01:20:24.858+00:00",{"slug":36,"title":37,"published_at":38},"mexc-crypto-exchange-banned-for-enabling-16b-in-illicit-transactions","MEXC Crypto Exchange Banned for Enabling $16B in Illicit Transactions","2026-11-09T14:21:04.771+00:00",{"slug":40,"title":41,"published_at":42},"ai-systems-can-exploit-complex-loopholes-without-malicious-intent","AI Systems Can Exploit Complex Loopholes Without Malicious Intent","2026-11-09T12:22:25.516+00:00",{"slug":44,"title":45,"published_at":46},"service-provider-compromise-leads-to-133m-bank-heist","Service Provider Compromise Leads to $133M Bank Heist","2026-11-09T11:22:43.404+00:00",{"slug":48,"title":49,"published_at":50},"100m-bank-fraud-via-compromised-supplier-platform","€100M Bank Fraud via Compromised Supplier Platform","2026-11-09T11:20:21.304+00:00",{"slug":52,"title":53,"published_at":54},"critical-linux-kernel-flaw-threatens-veeam-backup-appliances","Critical Linux Kernel Flaw Threatens Veeam Backup Appliances","2026-11-09T08:20:22.664+00:00",{"slug":56,"title":57,"published_at":58},"huaweis-all-chinese-pc-signals-deepening-tech-supply-chain-fragmentation","Huawei's All-Chinese PC Signals Deepening Tech Supply Chain Fragmentation","2026-11-09T03:20:48.629+00:00",{"slug":60,"title":61,"published_at":62},"third-party-provider-exploited-to-steal-133m-from-french-bank","Third-Party Provider Exploited to Steal $133M from French Bank","2026-11-08T12:20:25.51+00:00",{"slug":64,"title":65,"published_at":66},"ai-powered-artex-framework-breaches-seven-south-korean-banks-via-exposed-servers","AI-Powered ARTEX Framework Breaches Seven South Korean Banks via Exposed Servers","2026-11-07T20:20:22.382+00:00",[68,73,78,82,87,92],{"slug":69,"name":70,"problem":71,"stories":72},"privileged-access-management","Privileged access management (PAM)","Admin accounts stop being one stolen password away from control of everything.",26,{"slug":74,"name":75,"problem":76,"stories":77},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",25,{"slug":79,"name":80,"problem":81,"stories":77},"identity-threat-detection","Identity threat detection and response (ITDR)","Attackers who log in with real, stolen credentials get noticed.",{"slug":83,"name":84,"problem":85,"stories":86},"encryption-key-management","Encryption and key management","Stolen data stays unreadable, and the keys stay under your control.",18,{"slug":88,"name":89,"problem":90,"stories":91},"immutable-backup","Immutable backup and recovery","Ransomware cannot delete or encrypt your way back.",14,{"slug":93,"name":94,"problem":95,"stories":96},"incident-response-retainer","Incident response retainer","Experts are on call before the worst day, not searched for during it.",13,[98,104,110,116,122,128,134,139],{"family":99,"item":100,"code":101,"title":102,"together":103},"nist-csf","pr-aa","PR.AA-01","PR.AA: Identity Management, Authentication, and Access Control",105,{"family":105,"item":106,"code":107,"title":108,"together":109},"nist-800-53","si-2","SI-2","Flaw Remediation",104,{"family":111,"item":112,"code":113,"title":114,"together":115},"iso-27001","a-8-8","Annex A 8.8","ISO\u002FIEC 27001:2022 Annex A 8.8: Management of technical vulnerabilities",93,{"family":117,"item":118,"code":119,"title":120,"together":121},"cis","17","Control 17","Incident Response Management",70,{"family":123,"item":124,"code":125,"title":126,"together":127},"nis2","21-2-b","Article 21(2)(b)","Incident handling (Article 21(2)(b))",50,{"family":129,"item":130,"code":131,"title":132,"together":133},"mitre-attack","t1566","T1566","Phishing",49,{"family":117,"item":135,"code":136,"title":137,"together":138},"14","Control 14","Security Awareness and Skills Training",38,{"family":140,"item":141,"code":142,"title":143,"together":144},"gdpr","32","Article 32","Security of processing",29]