How do we show our management body has approved and oversees our ICT risk management framework?

Start

We must show our management body approves and oversees ICT risk

DORA makes the management body define, approve and oversee the ICT risk management arrangements, and bear ultimate responsibility for ICT risk. The pack's evidence is what the body did: minutes of its approvals and reports (EV-02) and its training record (EV-03). A framework document with a signature page alone is thin by comparison (judgement).

• Then: Has the body approved your scope assessment, confirmed by counsel?

Decision

Has the body approved your scope assessment, confirmed by counsel?

Everything else depends on what you are. The scope assessment gives the entity type, the framework, microenterprise status and TLPT identification. The management body approves it and counsel confirms it (DR-01), and the pack's approval record lists it first. Where your competent authority tells you something different, its view stands.

• Yes: Confirm with counsel who the management body is
• No, or not known: Settle scope and framework first

Outcome

Settle scope and framework first

Run the scope assessment, have counsel confirm it, and take it to the management body. Until then you cannot say which of the approvals below apply to you. An organisation that only supplies ICT services to a financial entity does not run this flow, because DORA's duties for the contract fall on the financial entity.

Step

Confirm with counsel who the management body is

The pack defines the management body as the body that effectively runs the entity or has key functions under the law that governs it, such as the board. The pack does not say whether a committee may approve in its place. Judgement: a committee can prepare and recommend, and the approving decision stays with the management body itself unless counsel confirms your law lets it delegate. Name the holder and a deputy (FW-07).

• Then: Do you follow the simplified framework (Article 16)?

Decision

Do you follow the simplified framework (Article 16)?

Small and non-interconnected investment firms, exempted payment and e-money institutions and some others follow the simplified framework, which asks the management body for less. Take the answer from your approved scope assessment. If you are not sure, judgement: take the full framework, which asks for more, until counsel confirms.

• Yes: simplified: Put the simplified framework's approvals to the body
• No, or not known: Put the six full-framework approvals to the body

Step

Put the simplified framework's approvals to the body

The management body bears overall responsibility for the simplified framework. It sets roles and the information security objectives, and approves and reviews the classification of assets, the main risks, the business impact analysis and the continuity plans. It reviews the budget at least once a year and sets its own reporting arrangements.

• Then: Do the minutes name each document, its version and the date?

Step

Put the six full-framework approvals to the body

The body approves each of: the framework; the digital operational resilience strategy with the risk tolerance; the ICT business continuity policy and the response and recovery plans; the ICT audit plans; the policy on ICT third-party arrangements; and the budget. The pack's record also holds the list of critical or important functions, which the body approves too.

• Then: Do the minutes name each document, its version and the date?

Decision

Do the minutes name each document, its version and the date?

The pack asks each approval to name what was approved and the date, and the minutes to carry the same words. Its guidance for the minutes adds the version (DR-07). A line saying the board 'approved the framework' with no version gives a reader nothing to check the document against (judgement). Hold the minute reference next to each approval.

• Yes: Has the body approved a review report within your review interval?
• No, or not known: Put it back to the body and minute it in full

Step

Put it back to the body and minute it in full

Bring each approval to the next meeting with the document and its version, and have the minutes name each one with the date. Where the body already approved a document, say so and record what is missing. Raise a gap in your tracker until the minutes are in place.

• Then: Has the body approved a review report within your review interval?

Decision

Has the body approved a review report within your review interval?

Under the full framework the pack's default is to review the framework at least every 12 months, after a major ICT-related incident, and after supervisory instructions or conclusions from resilience testing or audit (FW-60). A microenterprise reviews it periodically. The simplified framework asks for a periodic review and after major incidents (RQ-25), and the pack sets no yearly default for it, so use your own interval. A report on each review goes to the management body for approval (FW-61). Count the triggers since the last review, not only the calendar.

• Yes: Does the body get regular reports on ICT risk?
• No, or not known: Review the framework and take the report to the body

Step

Review the framework and take the report to the body

Name who writes the report. It is in a searchable electronic format, with the contents the pack's table lists for your framework. The body approves it, and it must be ready for the authority on request. Enter the review in the framework's review log with the reason, the changes made, the approval date and the next review due.

• Then: Does the body get regular reports on ICT risk?

Decision

Does the body get regular reports on ICT risk?

Under the full framework the body puts reporting channels in place that keep it informed of third-party arrangements, planned material changes to providers and their effect on critical or important functions, and at least major incidents with the response, recovery and corrective measures. Under the simplified framework it sets its own reporting arrangements. Answer on what it received in the last year.

• Yes: Minute the body's questions, answers and decisions
• No, or not known: Set the reporting calendar: report, owner, interval

Step

Set the reporting calendar: report, owner, interval

The pack's calendar lists six reports: third-party arrangements, major incidents, ICT risk findings, test results with deficiencies, the readiness counts (DM-01 to DM-08), and the framework review report. Each has an owner and an interval, which are yours to set. P09 and P18 own incident decisions and clocks, so the calendar only carries the report to the body.

• Then: Minute the body's questions, answers and decisions

Step

Minute the body's questions, answers and decisions

The evidence the pack names is the reports the body received, with its questions and decisions, and the incident and third-party items in them (RQ-05). A report that was sent and never discussed shows that it was delivered. Whether that counts as oversight is a judgement: a record of the body's questions and decisions is stronger evidence. Follow each decision until it is closed.

• Then: Is every member trained in ICT risk, as your standard requires?

Decision

Is every member trained in ICT risk, as your standard requires?

Under the full framework members keep their knowledge current, including specific training on a regular basis. The pack's default is training at least every 12 months, and for a new member within 3 months of appointment, with a named person keeping the record. Answer yes for the simplified framework, which has no such record on the checklist.

• Yes, or simplified: Is the third-party monitoring role designated by the body?
• No, or not known: Book the training and record it for each member

Step

Book the training and record it for each member

Give each untrained or new member a date and record the dates and topics. The pack's example shows a member appointed on 15 July 2026 and booked for 8 October 2026, inside the 3 months, as a Priority 2 gap until the training is done. Raise a gap for it in your tracker.

• Then: Is the third-party monitoring role designated by the body?

Decision

Is the third-party monitoring role designated by the body?

Other than a microenterprise, the entity establishes a role to monitor its ICT third-party arrangements, or designates a member of senior management responsible for overseeing the risk exposure and documentation. The pack lists the designation among the records. Answer yes if you are a microenterprise or follow the simplified framework.

• Yes, or does not apply: Keep the approval record, and a gap for anything missing
• No, or not known: Have the body designate the role and its reporting line

Step

Have the body designate the role and its reporting line

Name the role or senior manager, with a deputy (FW-07), and minute the designation, which is a judgement on how to evidence it. The role reports to the body through the reporting calendar (FW-10). Raise a gap in your tracker until it is minuted.

• Then: Keep the approval record, and a gap for anything missing

Step

Keep the approval record, and a gap for anything missing

Keep the minutes, the training record, the approved documents and the review report where the owner can hand them over within the pack's default of 5 working days, and for at least 3 years by default. Every item not fully in place goes into your gap tracker with one owner. A binding duty not in place at all is a blocking gap.

• Then: Has a review trigger or a material change happened, or is a year up?

Decision

Has a review trigger or a material change happened, or is a year up?

The framework's review triggers are a major ICT-related incident, supervisory instructions, and conclusions from resilience testing or audit (FW-60), and a change of scope appears in the pack's review log. A change in the profile, the register or a critical or important contract is a reason to repeat the readiness self-assessment (DR-18). Treat any of them, or your review date, as a reason to go round again. If you are not sure, go round again (judgement).

• Yes, or not known: Do you follow the simplified framework (Article 16)? (back to an earlier step)
• No: Approval and oversight are on record: repeat with each assessment

Outcome

Approval and oversight are on record: repeat with each assessment

The management body's approvals, reports, decisions and training are minuted and can be produced. Repeating this check with each readiness self-assessment is a judgement. The pack's default is to assess at least every 6 months and report the counts to the body each time (DR-18). The pack's briefing deck is a way to put them in front of it.