ICT Risk Management

Status: Work in progress

DORA Article 1(2) is sector-specific EU law for financial entities also identified as essential/important under NIS2, within the equivalent obligations covered by NIS2 Article 4. It does not exempt all financial-sector suppliers from NIS2. An ICT supplier is subject to direct ESA oversight only if designated critical under Article 31; contractual requirements can affect other suppliers.

ICT Risk Management Framework (Art. 5-16)

The standard DORA regime requires an ICT framework approved by management. First assess Article 4 proportionality, microenterprise adjustments and the separate Article 16 simplified framework.

Governance requirements

Requirement	Description	Article
Board accountability	Management bears ultimate responsibility for ICT risk management	Art. 5
ICT strategy	Documented Digital Operational Resilience Strategy	Art. 6
Risk tolerance	Defined and approved by the board	Art. 6
Annual review	At least annually, microenterprises periodically; also on Art. 6(5) event triggers	Art. 6

Framework components

ICT Asset Management (Art. 8)

Inventory requirements

Inventory of information and ICT assets, business functions and their dependencies (Art. 8(1), (4)–(6))
Classification by criticality
Dependency mapping
Update inventories after major changes; review classification and related documentation at least annually (Art. 8(1), (6))

Asset categories

Category	Examples
Hardware	Servers, network devices, endpoints
Software	Applications, OS, middleware
Data	Databases, storage, backups
Services	Cloud services, SaaS, outsourcing

Security and organisational measures

Technical measures

Encryption policy covering data at rest and in transit, based on approved data classification and ICT risk assessment (Regulation 2024/1774 Art. 6)
Network segmentation
Strong authentication for remote and privileged access, access to assets supporting critical or important functions and publicly accessible assets; methods proportionate to classification and risk (Regulation 2024/1774 Art. 21(f))
Patch management
Vulnerability management, including at least weekly automated scans and assessments of ICT assets supporting critical or important functions (Regulation 2024/1774 Art. 10(2))

Organisational measures

ICT security awareness and digital operational resilience training for all staff and senior management (Art. 13(6))
Incident response procedures (Art. 17)
Change management (Art. 9(4)(e))
Access control policies (Art. 9(4)(c)–(d))

Business Continuity (Art. 11-12)

Requirements

Area	Requirement
BCP	Documented Business Continuity Plan
DRP	ICT response and recovery plans (Art. 11(3)); priority for critical or important functions does not limit plans to critical systems
RTO/RPO	Defined and tested
Testing	Test ICT continuity and response/recovery plans at least annually for systems supporting all functions, and after substantive changes to systems supporting critical or important functions (Art. 11(6)(a)); test backup and restoration procedures periodically (Art. 12(2))

ICT Business Impact Analysis

The BIA assesses exposure to severe business disruptions and their potential impacts (Art. 11(5)). A practical sequence, prioritising critical or important functions:

Identify dependent ICT systems
Determine RTO/RPO
Identify single points of failure
Define recovery priorities

Next steps

Sources

Content reviewed: 6 September 2026. Primary sources: DORA, Incident reporting RTS — Art. 5, NIS2 — Art. 4.