DORA Article 5: Obligations, Deadlines & Penalties

Financial entities shall have in place an internal governance and control framework that ensures an effective and prudent management of ICT risk to achieve a high level of digital operational resilience. Regulation (EU) 2022/2554, Article 5, Article 5

The management body of the financial entity shall define, approve, oversee and be responsible for the implementation of all arrangements related to the ICT risk management framework. Regulation (EU) 2022/2554, Article 5, Article 5

The management body shall bear the ultimate responsibility for managing the financial entity’s ICT risk. Regulation (EU) 2022/2554, Article 5, Article 5

The management body shall put in place policies that aim to ensure the maintenance of high standards of availability, authenticity, integrity and confidentiality of data. Regulation (EU) 2022/2554, Article 5, Article 5

The management body shall set clear roles and responsibilities for all ICT-related functions and establish appropriate governance arrangements to ensure effective and timely communication, cooperation and coordination among those functions. Regulation (EU) 2022/2554, Article 5, Article 5

The management body shall bear the overall responsibility for setting and approving the digital operational resilience strategy, including the determination of the appropriate risk tolerance level of ICT risk. Regulation (EU) 2022/2554, Article 5, Article 5

The management body shall approve, oversee and periodically review the implementation of the financial entity’s ICT business continuity policy and ICT response and recovery plans. Regulation (EU) 2022/2554, Article 5, Article 5

The management body shall approve and periodically review the financial entity’s ICT internal audit plans, ICT audits and material modifications to them. Regulation (EU) 2022/2554, Article 5, Article 5

The management body shall allocate and periodically review the appropriate budget to fulfil the financial entity’s digital operational resilience needs in respect of all types of resources, including ICT security awareness programmes and training. Regulation (EU) 2022/2554, Article 5, Article 5

The management body shall approve and periodically review the financial entity’s policy on arrangements regarding the use of ICT services provided by ICT third-party service providers. Regulation (EU) 2022/2554, Article 5, Article 5

The management body shall put in place, at corporate level, reporting channels enabling it to be duly informed of arrangements with ICT third-party service providers, planned material changes, their impact, and major ICT-related incidents. Regulation (EU) 2022/2554, Article 5, Article 5

Financial entities, other than microenterprises, shall establish a role to monitor arrangements with ICT third-party service providers or designate a member of senior management as responsible for overseeing the related risk exposure and documentation. Regulation (EU) 2022/2554, Article 5, Article 5

Members of the management body of the financial entity shall actively keep up to date with sufficient knowledge and skills to understand and assess ICT risk and its impact, including by following specific training on a regular basis. Regulation (EU) 2022/2554, Article 5, Article 5