Translations:Digital Operational Resilienec Act (DORA)/22/en

Under DORA, financial entities are required to establish a comprehensive internal governance and control framework for managing information and communication technology (ICT) risks. This framework must be regularly reviewed and documented, with microenterprises only needing to conduct regular reviews. The goal is to effectively address ICT risks. The specific requirements for ICT risk management are set out in Article 5(2) DORA. Responsibility for defining, approving, and monitoring ICT risk management lies with the management body of the respective financial entity, which is also responsible for implementing the measures. Financial entities that are not classified as microenterprises must also establish an independent control function to oversee and manage ICT risks.