The documents DORA runs on and who signs them off: the full list of required policies, the resilience strategy, risk assessment and residual risk, the asset inventory, continuity testing, the framework review report, management body duties and internal audit.
Every policy, plan and register DORA and its ICT risk management RTS name, from the information security policy to the exit plans, with the common elements each policy must contain and who approves it.
The strategy Article 6(8) requires and the management body approves: risk tolerance and impact tolerance, information security objectives with KPIs and risk metrics, the ICT reference architecture, an optional multi-vendor strategy and yearly reporting on progress.
How DORA expects ICT risk to be assessed and accepted: the methodology in Article 3 of the RTS, risk treatment, the inventory of accepted residual risks reviewed yearly, risk assessments on major changes and legacy systems, and threat monitoring.
What a DORA asset inventory must record and how it is kept current: classified business functions and assets, mapped dependencies and third-party processes, the fields Article 4 of the RTS lists, criticality criteria and legacy system records.
How DORA continuity plans must be tested: yearly tests, severe but plausible scenarios, provider failure, switchover to redundant capacity, the scenario list for response and recovery plans, 2-hour recovery for market infrastructures, and reporting results.
The report supervisors can request on the yearly review of the ICT risk management framework: when reviews are due, the format and sections Article 27 of the RTS sets, incident-driven reviews and the shorter report for simplified-regime entities.
What DORA makes the board personally responsible for: approving the strategy, risk tolerance and key plans, budgeting for resilience, overseeing third-party arrangements, keeping ICT risk knowledge current, and exposure to penalties for breaches.
What DORA requires of internal audit: regular audits of the framework by auditors with ICT expertise and independence, the three lines of defence, audits of response and recovery plans, follow-up of critical findings and what applies to smaller entities.
Tell us what you're working on, whether it's a deployment, an audit, a security test or a cyber range. You'll speak with an engineer who can help you scope it.