DORA's Cryptography Rules: What Articles 6 And 7 Of RTS 2024/1774 Ask For

The EU’s Digital Operational Resilience Act (DORA) has applied to banks, insurers, investment firms, payment institutions and many other financial entities since 17 January 2025.¹ DORA itself sets out principles. The detail sits in technical standards, and one of them, Commission Delegated Regulation (EU) 2024/1774, contains two articles devoted to cryptography.²

This article walks through Articles 6 and 7 of that regulation paragraph by paragraph. It explains what each one asks for, what evidence tends to support it, and how the text relates to quantum computing. The articles themselves never name it, although recital 9 recognises quantum developments as a source of cryptographic risk and asks financial entities to manage such threats through monitoring and mitigation.³

Where These Rules Come From

The Delegated Regulation is a regulatory technical standard, often shortened to RTS, that specifies the tools, methods and policies DORA expects for managing ICT (information and communication technology) risk. It was adopted on 13 March 2024, published in the Official Journal on 25 June 2024 and entered into force on 15 July 2024. Its rules apply to financial entities through DORA, which has applied since 17 January 2025.²¹ Because it is a regulation, it applies directly in every Member State without national transposition.

Articles 6 and 7 sit in Title II, which covers financial entities subject to DORA’s full ICT risk management framework. Smaller entities listed in Article 16 of DORA, such as small and non-interconnected investment firms and some exempted payment and e-money institutions, follow a simplified framework instead.¹ That simplified framework, in Title III of the same regulation, has no equivalent article on cryptography, although cryptography still feeds into the general proportionality rule in Article 1.²

Article 6: The Encryption Policy

Article 6 requires financial entities to develop, document and implement a policy on encryption and cryptographic controls, as part of their wider ICT security policies.²

The policy must be built on an approved data classification and ICT risk assessment. It needs rules for encrypting data at rest and in transit, for encrypting data in use where necessary, for encrypting internal network connections and traffic with external parties, and for managing cryptographic keys (paragraph 2). Where data in use cannot be encrypted, it has to be processed in a separated and protected environment or given equivalent protection.

Paragraph 3 asks for criteria for choosing cryptographic techniques, based on leading practices, recognised standards and the classification of the assets involved. If an entity cannot follow leading practices or standards, it must adopt mitigation and monitoring measures.

Paragraph 4 is the one that matters most for quantum readiness. The policy must allow cryptographic technology to be updated or changed where necessary “on the basis of developments in cryptanalysis”.² Cryptanalysis is the study of how to break cryptography. If updating is not possible, the entity must again adopt mitigation and monitoring measures that keep it resilient.

Paragraph 5 closes the loop. Whenever mitigation and monitoring measures are used under paragraphs 3 or 4, the entity must record them and give a reasoned explanation for the choice.

Article 7: Key Management And The Certificate Register

Article 7 deals with cryptographic keys and certificates.²

• Paragraph 1: key management requirements must cover the whole lifecycle, from generation, renewal, storage, backup and archiving through retrieval, transmission, retirement, revocation and destruction.
• Paragraph 2: keys must be protected throughout that lifecycle against loss, unauthorised access, disclosure and modification, with controls based on data classification and risk assessment.
• Paragraph 3: there must be methods to replace keys that are lost, compromised or damaged.
• Paragraph 4: the entity must create and maintain a register of all certificates and certificate-storing devices, at least for ICT assets supporting critical or important functions, and keep it up to date.
• Paragraph 5: certificates must be renewed promptly, before they expire.

Mapping Each Paragraph To Evidence

Supervisors and internal auditors will look for documents and records that show each paragraph is met. The table below is a practical guide.

What This Means For Quantum Readiness

Neither article names quantum computing. In the author’s reading, though, a quantum computer able to break RSA and elliptic curve cryptography would be exactly the kind of development in cryptanalysis that paragraph 4 anticipates. EU guidance points the same way: the NIS Cooperation Group’s April 2026 FAQ on the EU post-quantum roadmap describes post-quantum cryptography as crucial for protecting financial systems under DORA.⁴ That FAQ is guidance and does not change the legal text.

Two practical consequences follow. First, you cannot update cryptography as cryptanalysis develops unless you know where each algorithm is used. Article 7(4) only requires a certificate register, but meeting Article 6(4) in practice depends on a wider view of algorithms, protocols and keys. Second, if some systems cannot be migrated in time, paragraph 5 means the decision and its reasons must be written down.