Small entity / proportionate regime

Your obligations

• 1

  Simplified ICT risk management framework, with a reduced documentation burden (Art. 16).

  The required procedures and documents are lighter than under the full regime, while still covering the same broad themes: governance, protection, continuity.

• 2

  Simplified inventory of critical systems and functions.

  This means identifying the applications and services whose unavailability would have the greatest impact on the business, without requiring an exhaustive map.

• 3

  Notification of major incidents using the same severity criteria, with lighter procedures.

  The triggering thresholds remain the same as under the full regime, but the expected reporting formalities are reduced.

• 4

  Tracking of ICT providers in an information register proportionate to the entity's size.

  A tracking table listing essential providers and their criticality level is generally enough to meet this requirement.