DORA — Digital Operational Resilience Act

Financial entities shall have an internal governance and control framework that ensures effective and prudent management of ICT risk.

Operate a governance structure where senior management is accountable for ICT risk and where roles, responsibilities, and oversight are clearly defined.

Financial entities shall have a sound, comprehensive and well-documented ICT risk management framework as part of their overall risk management system.

Maintain a written, current ICT risk framework that sits inside enterprise risk management — not a standalone document.

The ICT risk management framework shall include at least strategies, policies, procedures, ICT protocols and tools necessary to duly and adequately protect all information assets and ICT assets.

The framework must explicitly cover protection of all ICT and information assets — software, hardware, servers, and data.

The ICT risk management framework shall be documented and reviewed at least once a year, as well as upon the occurrence of major ICT-related incidents.

Review the framework annually at minimum, and additionally after any major ICT incident or supervisory finding.

Financial entities shall manage ICT third-party risk as an integral component of ICT risk, including a documented strategy for ICT third-party risk.

Treat third-party ICT risk as part of the core framework, with a register and exit plans for critical providers.

Financial entities shall test ICT business continuity plans and ICT response and recovery plans in respect of ICT systems supporting all functions at least yearly.

Run at least an annual full-restore test plus quarterly tabletop exercises across continuity and recovery plans.

In line with the principle of proportionality, the ICT risk management framework should reflect the size, business profile, and risk appetite of the financial entity.

Apply proportionality — a small payments firm need not match a tier-1 bank, but the basis for that judgement must be documented.