What it asks for. Article 5 requires financial entities to have an internal governance and control framework that ensures effective and prudent management of ICT risk. The management body bears ultimate responsibility for managing ICT risk and must define, approve, oversee and be accountable for the ICT risk management framework.
In practice. The management body approves the digital operational resilience strategy, ICT policies, business continuity policy and audit plans, allocates budget, sets roles and reporting lines, and receives regular reporting. Members keep their ICT risk knowledge current through training. Evidence includes approvals in board minutes, role definitions, budget decisions and training records.
Common gaps. Boards often delegate ICT risk to the CIO or CISO without real oversight. The required control function for ICT risk may lack independence from operations.