DORA Control Implementation

The ICT risk management framework determines which types of controls are broadly needed. Control implementation is the practical execution: actually deploying individual controls, technically or organizationally, such as a specific access rule or an approval process. A framework without implemented controls is just a statement of intent.

The starting point is the risk assessment documented in the framework: for each identified risk above the tolerance threshold, one or more concrete controls are defined to bring it down to an acceptable level. Controls that can't be traced back to a specific risk assessment are hard to justify later and should be avoided.

Evidence usually combines technical testing, such as verifying an access rule actually applies, with sample-based checks during ongoing operation. A control tested only at rollout and never revisited can silently lose its effectiveness after later system changes.

A defined process that automatically checks, at every material change to an ICT system, whether existing controls still apply or need adjustment works well. Without that link to change management, controls gradually lose relevance over time without it becoming immediately obvious.

A central control register referencing the risk each control addresses, its owner, and the date of its last review creates transparency about which controls actually exist and how current they are. Without such a register, knowledge of existing controls often sits with individual people, leading to knowledge loss when staff change.