[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"framework:dora\u002F5":3},{"item":4,"lessons":16,"controls":22,"related":35},{"family":5,"item":6,"code":7,"title":8,"citations":9,"publisher":10,"summary_md":11,"official_text":12,"official_attribution":12,"official_url":13,"link_label":14,"note":12,"updated_at":15},"dora","5","Article 5","Governance and organisation",1,"Regulation (EU) 2022\u002F2554 (Digital Operational Resilience Act)","**What it asks for.** Article 5 requires financial entities to have an internal governance and control framework that ensures effective and prudent management of ICT risk. The management body bears ultimate responsibility for managing ICT risk and must define, approve, oversee and be accountable for the ICT risk management framework.\n\n**In practice.** The management body approves the digital operational resilience strategy, ICT policies, business continuity policy and audit plans, allocates budget, sets roles and reporting lines, and receives regular reporting. Members keep their ICT risk knowledge current through training. Evidence includes approvals in board minutes, role definitions, budget decisions and training records.\n\n**Common gaps.** Boards often delegate ICT risk to the CIO or CISO without real oversight. The required control function for ICT risk may lack independence from operations.",null,"https:\u002F\u002Feur-lex.europa.eu\u002Flegal-content\u002FEN\u002FTXT\u002FHTML\u002F?uri=CELEX:32022R2554#art_5","Read the official text on EUR-Lex","2026-10-18T15:18:43.664+00:00",{"total":9,"list":17},[18],{"slug":19,"title":20,"published_at":21},"ai-accelerated-exploits-expose-financial-sectors-legacy-software-supply-chain-risks","AI-Accelerated Exploits Expose Financial Sector's Legacy Software Supply Chain Risks","2026-10-01T14:21:40.965+00:00",[23,27,31],{"slug":24,"name":25,"problem":26,"stories":9},"patch-management","Automated patch management","Known holes get closed in days, not months.",{"slug":28,"name":29,"problem":30,"stories":9},"software-supply-chain","Software supply chain security","Malicious and vulnerable open-source packages are caught before they ship.",{"slug":32,"name":33,"problem":34,"stories":9},"vulnerability-management","Vulnerability scanning and prioritisation","You know which systems are vulnerable, and which ones to fix first.",[36,41,45,50,54,59,63,68],{"family":37,"item":38,"code":39,"title":40,"together":9},"cis","2","Control 2","Inventory and Control of Software Assets",{"family":37,"item":42,"code":43,"title":44,"together":9},"7","Control 7","Continuous Vulnerability Management",{"family":46,"item":47,"code":48,"title":49,"together":9},"gdpr","32","Article 32","Security of processing",{"family":51,"item":52,"code":53,"title":53,"together":9},"itil","overview","ITIL",{"family":55,"item":56,"code":57,"title":58,"together":9},"nist-800-53","ra-5","RA-5","Vulnerability Monitoring and Scanning",{"family":55,"item":60,"code":61,"title":62,"together":9},"sa-12","SA-12","Supply Chain Protection",{"family":64,"item":65,"code":66,"title":67,"together":9},"nist-csf","id-sc","ID.SC-4","Supply Chain Risk Management (CSF 1.1)",{"family":69,"item":70,"code":71,"title":72,"together":9},"nist-sp","800-161","SP 800-161","SP 800-161 Rev. 1: Cybersecurity Supply Chain Risk Management Practices for Systems and Organizations"]