Governance and organisation (Art. 5–6)

The management body must approve the ICT risk strategy, allocate an appropriate ICT budget and ensure the ICT function has qualified staff. An internal control function (second line) and internal audit function (third line) must independently assess ICT risks. The CISO (or equivalent) reports directly to the management body at least annually.

ICT asset management (Art. 8)

A complete, up-to-date inventory of all hardware and software ICT assets is mandatory. Assets must be classified by criticality to business functions. The RTS on ICT risk management tools (Commission Delegated Regulation 2024/1774) specifies the minimum fields for the asset register and the review frequency (at least annually, or after any significant change).

Protection and prevention (Art. 9)

Minimum controls include: network segmentation, multi-factor authentication for privileged accounts, encryption of data in transit and at rest (AES-256 or equivalent), patch management with defined SLAs by criticality, and an information security management policy formally approved by the management body.

Detection (Art. 10)

Financial entities must implement mechanisms to promptly detect anomalous ICT activities — including activities at third-party access points. This typically requires a SIEM (Security Information and Event Management) system with defined alert thresholds and an on-call escalation process. The RTS requires documented baseline normal behaviour for critical systems.

Response, recovery and learning (Art. 11–13)

A documented Business Continuity Plan (BCP) and ICT Disaster Recovery Plan (DRP) with defined RPO and RTO targets are required. Plans must be tested annually (or after a major change). Post-incident reviews must be conducted for all major incidents and shared with the management body within 3 months.

Asset register not formally approved by management body

Many entities maintain an IT asset list in a spreadsheet but lack documented management body approval and a defined review cycle.

BCP/DRP not tested in the last 12 months

DORA Art. 11 requires annual testing of response and recovery capabilities. Tabletop exercises count, but must be documented with outcomes and remediation actions.

SaaS providers missing from the ICT third-party register

Cloud tools used by business units (CRM, HR, communication platforms) are often overlooked. Under DORA, any third-party ICT service that supports a business function must be in the register.

No documented cryptography policy

The RTS on ICT risk management tools requires a formal cryptography and key management policy. Many entities rely on vendor defaults without documenting the standards applied.

CISO report to board not documented

DORA Art. 5.4 requires the ICT risk function to report at least once a year to the management body. This report — with its agenda, minutes and action points — is a key piece of audit evidence.