What it asks for. The European Supervisory Authorities, through the Joint Committee and in consultation with ENISA, must develop regulatory technical standards that specify further elements of the ICT risk management requirements, taking proportionality into account.
In practice. The standards cover ICT security policies, procedures, protocols and tools, including network security, access control, cryptography, ICT project and change management, patching and physical security, together with anomaly detection, business continuity policy and testing, and the content of the review report on the ICT risk management framework. These were adopted as a Commission Delegated Regulation that also sets out the simplified framework. Organisations should perform a gap assessment against the standards, map each requirement to policies and controls, and keep that mapping current as evidence for supervisors.
Common gaps. Organisations often implement the high-level DORA articles but miss the detailed requirements in the technical standards, such as specific policy content and documentation expectations.