> For the complete documentation index, see [llms.txt](https://www.mica.wtf/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://www.mica.wtf/eu-level/q-and-a/eba-qa-2024-7178-elaboration-on-the-meaning-of-a-separated-and-dedicated-netw.md). # Elaboration on the meaning of a separated and dedicated n... | | | | ---------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------- | | **Authority** | EBA | | **Q\&A ID** | EBA\_QA\_2024\_7178 | | **Topic** | ICT third-party risk management | | **Legal basis** | [Article 13(1)](https://www.mica.wtf/dora/digital-operational-resilience-act/chapter-ii-ict-risk-management/article-13-learning-and-evolving) DORA | | **Status** | Final Q\&A | | **Published** | 25/07/2025 | | **Submitted** | 19/08/2024 | | **Answer prepared by** | Answer prepared by the Joint ESAs Q\&A | | **Source** | [EBA Q\&A](https://www.eba.europa.eu/single-rule-book-qa/qna/view/publicId/2024_7178) | ## Question In the "RTS on ICT Risk Management Framework and on simplified ICT Risk Management Framework"; How should we read: ''A separate and dedicated network for ICT asset administration, along with strict prohibition of direct internet access\[...]'' ? (article 13, paragraph 1, sub (c)). A separate and dedicated network could be on-premises, but is a virtual-LAN sufficient? or is it enough to have it in the regular production-LAN with other systems? and what if the CMDB is in a cloud environment? is it then a de facto separated and dedicated network or not? ## Background ICT asset administration happens in an Configuration Management Database (CMDB), these can be hosted on-premises or in the cloud but in either case it is important to know how to interpret (especially) the ''separate and dedicated network" as it is multi-interpretable by being a virtual-LAN but also a complete physically separated network. In the case of a cloud-hosted solution there could be an issue, as it is not clear if these types of solutions adhere to this requirement in the strictest interpretation. Depending on the level of interpretation, this could greatly effect the architecture of CMDB systems in institutions. ## Final answer DORA regulation and the corresponding technical standards are principle-based ( Delegated regulation - EU - 2024/1774 - EN - EUR-Lex ) and technology agnostic and thus they do not identify specific configurations to ensure they can remain future-proof and that financial entities can decide on the specific arrangements based on their needs, their bespoke environment and their ICT risk assessment. In this context, logical (e.g. using of virtual-LAN (vLAN) or a cloud-based solution), physical separation or a combination of both may or may not serve as adequate controls to meet the requirement of “(c)the use of a separate and dedicated network for the administration of ICT assets” (RTS on ICT risk management Article 13(c)). The decision on which controls to implement to ensure such separation would need to be taken in accordance with Article 13 point (a) and in compliance with Article 13 as a whole for network security management aspects. For example, in the case of isolating an administrative network, where ensuring sufficient separation is key, it is also important to stress that a virtual LAN (vLAN) alone may not be sufficient to ensure effective isolation of the administrative network. In this case, the financial entity should assess whether the logical segregation alone is sufficient and in the case of opting for a VLAN at least consider complementing vLAN with additional controls (e.g. a firewall with an appropriate filtering policy, or implementing appropriate routing, etc). Furthermore, it is important to note that any decision on the use of the regular production-LAN with other systems, would need to consider also at a minimum the requirements under Article 8(2)(b), and Recital 10. --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question. Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter: ``` GET https://www.mica.wtf/eu-level/q-and-a/eba-qa-2024-7178-elaboration-on-the-meaning-of-a-separated-and-dedicated-netw.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.