[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"framework:dora\u002F16":3},{"item":4,"lessons":16,"controls":18,"related":19},{"family":5,"item":6,"code":7,"title":8,"citations":9,"publisher":10,"summary_md":11,"official_text":12,"official_attribution":12,"official_url":13,"link_label":14,"note":12,"updated_at":15},"dora","16","Article 16","Simplified ICT risk management framework",0,"Digital Operational Resilience Act","**What it asks for.** Certain smaller financial entities, including small and non-interconnected investment firms, some exempted payment and electronic money institutions, small occupational pension institutions and some exempted credit institutions, may apply a simplified ICT risk management framework instead of the full requirements of Articles 5 to 15.\n\n**In practice.** The simplified framework still requires documented mechanisms and measures to mitigate ICT risk, continuous monitoring of the security and functioning of ICT systems, sound and up-to-date systems to minimise the impact of ICT risk, prompt identification of sources of risk and anomalies, identification of key dependencies on ICT third-party providers, business continuity plans with response and recovery measures, regular testing, and implementation of lessons learned. The framework is reviewed periodically and after major incidents. Eligible entities should document why they qualify and keep evidence of each element.\n\n**Common gaps.** Entities sometimes assume the simplified regime removes obligations entirely, or apply it without confirming eligibility, and still lack tested continuity plans.",null,"https:\u002F\u002Feur-lex.europa.eu\u002Flegal-content\u002FEN\u002FTXT\u002FHTML\u002F?uri=CELEX:32022R2554#art_16","Read the article on EUR-Lex","2026-10-18T15:18:43.664+00:00",{"total":9,"list":17},[],[],[]]