Article 5Governance and organisation

What it says

1. Financial entities shall have in place an internal governance and control framework that ensures an effective and prudent management of ICT risk, in accordance with Article 6(4), in order to achieve a high level of digital operational resilience.

2. The management body of the financial entity shall define, approve, oversee and be responsible for the implementation of all arrangements related to the ICT risk management framework referred to in Article 6(1).

For the purposes of the first subparagraph, the management body shall:

(a) bear the ultimate responsibility for managing the financial entity’s ICT risk;

(b) put in place policies that aim to ensure the maintenance of high standards of availability, authenticity, integrity and confidentiality, of data;

(c) set clear roles and responsibilities for all ICT-related functions and establish appropriate governance arrangements to ensure effective and timely communication, cooperation and coordination among those functions;

Show the rest of the text(11 more paragraphs, about 380 words)

(d) bear the overall responsibility for setting and approving the digital operational resilience strategy as referred to in Article 6(8), including the determination of the appropriate risk tolerance level of ICT risk of the financial entity, as referred to in Article 6(8), point (b);

(e) approve, oversee and periodically review the implementation of the financial entity’s ICT business continuity policy and ICT response and recovery plans, referred to, respectively, in Article 11(1) and (3), which may be adopted as a dedicated specific policy forming an integral part of the financial entity’s overall business continuity policy and response and recovery plan;

(f) approve and periodically review the financial entity’s ICT internal audit plans, ICT audits and material modifications to them;

(g) allocate and periodically review the appropriate budget to fulfil the financial entity’s digital operational resilience needs in respect of all types of resources, including relevant ICT security awareness programmes and digital operational resilience training referred to in Article 13(6), and ICT skills for all staff;

(h) approve and periodically review the financial entity’s policy on arrangements regarding the use of ICT services provided by ICT third-party service providers;

(i) put in place, at corporate level, reporting channels enabling it to be duly informed of the following:

(i) arrangements concluded with ICT third-party service providers on the use of ICT services,

(ii) any relevant planned material changes regarding the ICT third-party service providers,

(iii) the potential impact of such changes on the critical or important functions subject to those arrangements, including a risk analysis summary to assess the impact of those changes, and at least major ICT-related incidents and their impact, as well as response, recovery and corrective measures.

3. Financial entities, other than microenterprises, shall establish a role in order to monitor the arrangements concluded with ICT third-party service providers on the use of ICT services, or shall designate a member of senior management as responsible for overseeing the related risk exposure and relevant documentation.

4. Members of the management body of the financial entity shall actively keep up to date with sufficient knowledge and skills to understand and assess ICT risk and its impact on the operations of the financial entity, including by following specific training on a regular basis, commensurate to the ICT risk being managed.

DORA, the European Union regulation on digital operational resilience, Article 5

What it means in practice

What is in the packs for this

Each one helps with this requirement.

• XLSExcel

  DORA Article-to-Control Mapping Library

  in DORA ICT Risk & Resilience ReadinessRequirement Library rows RQ-04, RQ-05, RQ-06, RQ-45: The management body owns ICT risk; Reporting channels to the management body; Members keep their ICT knowledge current; A role to monitor the arrangements.
• XLSExcel

  DORA Readiness Self-Assessment

  in DORA ICT Risk & Resilience ReadinessReadiness items RM-01, TP-02: The management body governs ICT risk; Third-party strategy, policy and monitoring role. Each rates how ready the entity is, with the evidence and the gap.
• DOCWord

  ICT Risk Management Framework Document Template

  in DORA ICT Risk & Resilience ReadinessGovernance, control and audit section: approvals and responsibility of the management body (FW-04, FW-05).
• PPTPowerPoint

  Management Body DORA Briefing Deck

  in DORA ICT Risk & Resilience ReadinessBriefing slide 4 sets out the management body's duties of direction and plans, slide 5 its duties on audit, money, providers and reports, slide 8 the provider monitoring role and slide 11 its own training.
• XLSExcel

  Board Metric Selection Catalogue

  in Board Cybersecurity ReportingHolds the board metric BM-01 read against the risk tolerance the management body sets, and BM-08 on the management body's knowledge and training.
• XLSExcel

  Board Reporting Data Collection Workbook

  in Board Cybersecurity ReportingThe Cycle Control and Deck Feed sheet sets a regular reporting channel to the management body that includes incidents (BM-04).
• DOCWord

  Board Question Bank & Preparation Brief

  in Board Cybersecurity ReportingQuestions BQ-16 and BQ-17 prepare the board on its own duties for ICT risk, and BQ-18 on board training.
• XLSExcel

  Board & Executive Reporting Calendar

  in Board Cybersecurity ReportingThe Annual Items list schedules the management body's training.
• XLSExcel

  Role-Based Security Training Matrix

  in Security Awareness ProgrammeThe financial-entity note covers the management body's own training, which the matrix shows as one column.
• DOCWord

  Business Continuity & ICT Resilience Policy

  in Business Continuity, Disaster Recovery & Cyber ResilienceSets approval by the approver and the yearly report to it (RR-20).