ICT Risk Management under DORA

What the framework must cover

• Strategies, policies, procedures, and tools to protect information and ICT assets.
• Identification and classification of ICT-supported business functions and assets.
• Continuous monitoring and detection of anomalous activity.
• ICT business-continuity and disaster-recovery plans, tested regularly.
• Mechanisms to learn from incidents and evolve the framework.

Governance and accountability

The management body bears ultimate responsibility. It must approve the framework, allocate budget, and maintain sufficient ICT knowledge: resilience is a board-level obligation, not solely an IT function.

A fast-moving risk: AI-driven cyber threats

The framework is not a one-time build. In July 2026 the European Systemic Risk Board warned that frontier AI models are materially raising systemic cyber risk, and the ECB followed with a letter requiring significant institutions to have an AI-cyber action plan by 31 October 2026, both feed directly into the Article 6 obligation to keep the framework current against emerging threats. See our coverage of the warning and the ECB deadlinefor what it means in practice. The ESAs' Autumn 2026 joint risk update later named the same AI-accelerated cyber risk as one of three vulnerabilities supervisors should watch most closely; see our coverage of that update for what it adds for ICT risk management and third-party risk specifically.

Proportionality: a simplified framework for smaller entities

Not every in-scope entity has to build the full Article 5-15 regime from scratch. Article 16 carves out a simplified ICT risk management framework for small and non-interconnected investment firms, payment institutions exempted under Directive (EU) 2015/2366 (PSD2), electronic money institutions exempted under Directive 2009/110/EC, institutions covered by the Article 2(4) waiver under Directive 2013/36/EU, and small institutions for occupational retirement provision. These entities still need a documented ICT risk approach, monitoring of their systems, a business-continuity plan, and a record of third-party dependencies, but the depth of testing and the frequency of review scale down with the entity's size and interconnectedness. Proportionality reduces the compliance burden; it does not remove the underlying obligation to manage ICT risk (see our explainer on the management body's specific duties for how the same proportionality principle applies to board-level oversight).

The framework in practice: eight required pieces

Article 6 sets the duty in five verbs (identify, protect, detect, respond, recover), but Articles 8 through 15 turn those into eight separate deliverables a supervisor can ask to see: an ICT asset inventory (Article 8), protection and prevention controls (Article 9), detection capability (Article 10), response and recovery plans that state a recovery time objective for each critical system (Article 11), tested backup and restoration procedures (Article 12), a learning loop that feeds incidents back into the framework (Article 13), crisis communication plans (Article 14), and the RTS under Article 15 that fills in the technical detail for the rest. A single combined "ICT risk policy" document rarely satisfies all eight: supervisors expect each piece mapped to its own owned document, and DORA treats an untested recovery plan the same way it treats an untested backup, as good as absent. For the full breakdown of what each of the eight pieces has to contain, see our guide to the DORA ICT risk management framework.