Article 5Governance and organisation
1. Financial entities shall have in place an internal governance and control framework that ensures an effective and prudent management of ICT risk, in accordance with Article 6(4), in order to achieve a high level of digital operational resilience.
2. The management body of the financial entity shall define, approve, oversee and be responsible for the implementation of all arrangements related to the ICT risk management framework referred to in Article 6(1).
For the purposes of the first subparagraph, the management body shall:
(a) bear the ultimate responsibility for managing the financial entity’s ICT risk;
(b) put in place policies that aim to ensure the maintenance of high standards of availability, authenticity, integrity and confidentiality, of data;
(c) set clear roles and responsibilities for all ICT-related functions and establish appropriate governance arrangements to ensure effective and timely communication, cooperation and coordination among those functions;
(d) bear the overall responsibility for setting and approving the digital operational resilience strategy as referred to in Article 6(8), including the determination of the appropriate risk tolerance level of ICT risk of the financial entity, as referred to in Article 6(8), point (b);
(e) approve, oversee and periodically review the implementation of the financial entity’s ICT business continuity policy and ICT response and recovery plans, referred to, respectively, in Article 11(1) and (3), which may be adopted as a dedicated specific policy forming an integral part of the financial entity’s overall business continuity policy and response and recovery plan;
(f) approve and periodically review the financial entity’s ICT internal audit plans, ICT audits and material modifications to them;
(g) allocate and periodically review the appropriate budget to fulfil the financial entity’s digital operational resilience needs in respect of all types of resources, including relevant ICT security awareness programmes and digital operational resilience training referred to in Article 13(6), and ICT skills for all staff;
(h) approve and periodically review the financial entity’s policy on arrangements regarding the use of ICT services provided by ICT third-party service providers;
(i) put in place, at corporate level, reporting channels enabling it to be duly informed of the following:
(i) arrangements concluded with ICT third-party service providers on the use of ICT services,
(ii) any relevant planned material changes regarding the ICT third-party service providers,
(iii) the potential impact of such changes on the critical or important functions subject to those arrangements, including a risk analysis summary to assess the impact of those changes, and at least major ICT-related incidents and their impact, as well as response, recovery and corrective measures.
3. Financial entities, other than microenterprises, shall establish a role in order to monitor the arrangements concluded with ICT third-party service providers on the use of ICT services, or shall designate a member of senior management as responsible for overseeing the related risk exposure and relevant documentation.
4. Members of the management body of the financial entity shall actively keep up to date with sufficient knowledge and skills to understand and assess ICT risk and its impact on the operations of the financial entity, including by following specific training on a regular basis, commensurate to the ICT risk being managed.
DORA, the European Union regulation on digital operational resilience, Article 5
Responsibility for ICT risk sits with the management body, and the Regulation lists the decisions it must take itself. Entities must have an internal governance and control framework for prudent ICT risk management, and the management body defines, approves, oversees and is responsible for implementing all arrangements under the ICT risk management framework. It bears ultimate responsibility for ICT risk; puts in place policies aimed at high standards of availability, authenticity, integrity and confidentiality of data; sets roles and responsibilities for ICT functions and how they coordinate; sets and approves the resilience strategy and ICT risk tolerance; approves, oversees and periodically reviews continuity and response and recovery arrangements; approves ICT audit plans; allocates budget, including training and skills; and approves the policy on ICT third-party services.
It must also put in place reporting channels so it is told about third-party arrangements, planned material changes to them and their impact on critical or important functions, and at least major incidents and the recovery and corrective measures.
Entities other than microenterprises must also create a role, or designate a senior manager, to oversee third-party arrangements and their documentation.
Members must keep their own knowledge and skills current, with regular training matching the ICT risk managed. Ultimate responsibility stays with the management body, whoever does the work.
What is in the packs for this
Each one helps with this requirement.
DORA Article-to-Control Mapping LibraryExcel
in DORA ICT Risk & Resilience Readiness
Requirement Library rows RQ-04, RQ-05, RQ-06, RQ-45: each gives the provision in plain words, what an entity must be able to show and the documents that help.
DORA Readiness Self-AssessmentExcel
in DORA ICT Risk & Resilience Readiness
Readiness items RM-01, TP-02 rate how ready the entity is for the provision, with the evidence behind each rating and the gap.
ICT Risk Management Framework Document TemplateWord
in DORA ICT Risk & Resilience Readiness
Governance, control and audit section: approvals and responsibility of the management body (FW-04, FW-05).
Management Body DORA Briefing DeckPowerPoint
in DORA ICT Risk & Resilience Readiness
Briefing slide 4 sets out the management body's duties of direction and plans, slide 5 its duties on audit, money, providers and reports, slide 8 the provider monitoring role and slide 11 its own training.
Board Metric Selection CatalogueExcel
in Board Cybersecurity Reporting
Holds the board metric BM-01 read against the risk tolerance the management body sets, and BM-08 on the management body's knowledge and training.
Board Reporting Data Collection WorkbookExcel
in Board Cybersecurity Reporting
The Cycle Control and Deck Feed sheet sets a regular reporting channel to the management body that includes incidents (BM-04).
Board Question Bank & Preparation BriefWord
in Board Cybersecurity Reporting
Questions BQ-16 and BQ-17 prepare the board on its own duties for ICT risk, and BQ-18 on board training.
Board & Executive Reporting CalendarExcel
in Board Cybersecurity Reporting
The Annual Items list schedules the management body's training.
Role-Based Security Training MatrixExcel
in Security Awareness Programme
The financial-entity note covers the management body's own training, which the matrix shows as one column.
Business Continuity & ICT Resilience PolicyWord
in Cyber Resilience & Recovery
Sets approval by the approver and the yearly report to it (RR-20).
Text: Regulation (EU) 2022/2554, as published in the Official Journal of the European Union, from EUR-Lex. Only the Official Journal text is authentic.