DORA ICT Risk Management

Article 5 forms the overarching framework for all ICT risk management: identification, protection, detection, response, and recovery related to ICT risk, each with management body accountability. Articles 6‑14 detail the individual elements of this framework; Article 5 itself provides the structural umbrella.

Article 5 describes the substantive set of ICT risk management obligations as a whole. Article 6 specifies how that set of obligations must be captured in a documented framework approved by the management body, including its review cycle. Article 5 is the substantive scope; Article 6 is the formal documentation requirement built on top of it.

Without a complete inventory of all ICT assets, processes, and dependencies, including those from ICT third-party providers, risk cannot be reliably assessed. Identification is therefore not a one-time inventory but must be updated with every material change to the IT landscape, since new risks otherwise go undetected.

These include access controls, network segmentation, encryption of sensitive data, and regular vulnerability scans, among others. DORA doesn't mandate a specific technology; it requires the chosen measures to be proportionate to the actual risk profile of the systems involved. A standard measure package with no tie to individual risk assessment rarely satisfies this.

This requires defined processes for continuous monitoring, clear escalation paths for detected anomalies, and prepared response plans for different incident types. A purely technical detection solution without established organizational response paths significantly delays actual response when it matters most.

Common practice combines internal audits, regular testing of implemented controls, and analysis of actual incidents for patterns pointing to systemic weaknesses. A review that only checks whether documents formally exist, without testing actual operational effectiveness, doesn't fully meet the requirement.