Article 7ICT systems, protocols and tools
In order to address and manage ICT risk, financial entities shall use and maintain updated ICT systems, protocols and tools that are:
(a) appropriate to the magnitude of operations supporting the conduct of their activities, in accordance with the proportionality principle as referred to in Article 4;
(b) reliable;
(c) equipped with sufficient capacity to accurately process the data necessary for the performance of activities and the timely provision of services, and to deal with peak orders, message or transaction volumes, as needed, including where new technology is introduced;
(d) technologically resilient in order to adequately deal with additional information processing needs as required under stressed market conditions or other adverse situations.
DORA, the European Union regulation on digital operational resilience, Article 7
Four requirements. The ICT systems, protocols and tools an entity uses and keeps updated must be appropriate to the magnitude of the operations supporting its activities in line with the proportionality principle; reliable; equipped with sufficient capacity to process data accurately and deliver services on time, including at peak order, message or transaction volumes and where new technology is introduced; and technologically resilient enough to handle additional processing needs under stressed market conditions or other adverse situations.
Capacity under peak load and resilience under stressed conditions can be tested, and Article 25 lists performance testing and end-to-end testing among the tests a resilience testing programme may include.
What is in the packs for this
From DORA ICT Risk & Resilience Readiness. Each one helps with this requirement.
DORA Article-to-Control Mapping LibraryExcel
Requirement Library rows RQ-11: each gives the provision in plain words, what an entity must be able to show and the documents that help.
DORA Readiness Self-AssessmentExcel
Readiness items RM-05 rate how ready the entity is for the provision, with the evidence behind each rating and the gap.
ICT Risk Management Framework Document TemplateWord
Statement FW-28 on reliable, resilient systems.
Text: Regulation (EU) 2022/2554, as published in the Official Journal of the European Union, from EUR-Lex. Only the Official Journal text is authentic.