DORA Chapter II (Articles 5 to 16) with the proportionality principle of Article 4: governance, the ICT risk management framework, identification, protection, detection, response and recovery, backup, learning, communication and the simplified regime.
How DORA scales its requirements to an entity's size, overall risk profile and the nature, scale and complexity of its activities, which chapters the principle governs, and how supervisors check that it was applied reasonably.
The management body's ultimate responsibility for ICT risk: what it must define, approve and review, the reporting lines it needs on ICT third-party arrangements and incidents, the third-party monitoring role, and the ICT training board members must follow.
The documented framework at the centre of Chapter II: strategies, policies, procedures, protocols and tools; the independent ICT risk control function; annual review and review report; internal audit; and the digital operational resilience strategy with risk tolerance and metrics.
The requirement that ICT systems, protocols and tools be kept up to date, reliable, sized for peak volumes and technologically resilient under stressed conditions, and the capacity and performance procedures in the ICT risk management RTS that support it.
Identifying, classifying and documenting ICT-supported business functions, information and ICT assets, their dependencies and third-party interconnections; keeping inventories; continuous risk identification; and the yearly reviews and legacy system assessments DORA requires.
Continuous monitoring and control of ICT systems and the core protective policies DORA names: information security policy, network management with segmentation, least-privilege access, strong authentication and key protection, change management and patching.
Mechanisms to promptly detect anomalous activity, network performance issues and incidents, with layered controls, alert thresholds and automatic alerting, plus the logging and detection criteria set by the ICT risk management RTS.
The ICT business continuity policy, response and recovery plans, business impact analysis, yearly testing with cyber-attack and switchover scenarios, the crisis management function, and the estimate of annual incident costs and losses supervisors can request.
Backup scope and frequency, restoration and recovery procedures, segregated restore environments, redundant capacity, secondary sites for central securities depositories, recovery time and point objectives, and data integrity checks after recovery.
Gathering threat and vulnerability information, post-incident reviews after major incidents, feeding test and incident lessons into risk assessment, yearly reporting to the management body, compulsory security awareness and resilience training, and tracking technology developments.
Crisis communication plans for responsible disclosure of major incidents and vulnerabilities, internal and external communication policies, the person responsible for the public and media function, and how crisis communication is tested.
The lighter ICT risk management regime for small and non-interconnected investment firms, exempted payment and e-money institutions and small pension funds: which entities qualify, what they must still do, and the detailed requirements in Title III of the RTS.
Tell us what you're working on, whether it's a deployment, an audit, a security test or a cyber range. You'll speak with an engineer who can help you scope it.