What it asks for. This regulatory technical standard supplements DORA by specifying the elements of the ICT risk management framework and the simplified framework for smaller entities. It details requirements on ICT security policies, asset management, cryptography, operations security, network security, project and change management, physical security, access control, logging, incident detection and response, and business continuity.
In practice. Financial entities map their policies and controls against each article of the standard, for example defining logging procedures, protocols and tools, with log retention and protection set according to risk. Gaps are tracked and closed under management oversight. Evidence includes the mapping, policies and operational records demonstrating the requirements are applied.
Common gaps. Entities often stop at the main DORA text and miss the detail in this standard. Logging and cryptographic key management are frequently less mature than required.