[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"framework:dora\u002F6":3},{"item":4,"lessons":16,"controls":18,"related":19},{"family":5,"item":6,"code":7,"title":8,"citations":9,"publisher":10,"summary_md":11,"official_text":12,"official_attribution":12,"official_url":13,"link_label":14,"note":12,"updated_at":15},"dora","6","Article 6","ICT risk management framework",0,"Regulation (EU) 2022\u002F2554 (Digital Operational Resilience Act)","**What it asks for.** Financial entities must have a sound, comprehensive and well-documented ICT risk management framework as part of their overall risk management system, covering strategies, policies, procedures, ICT protocols and tools needed to protect information and ICT assets.\n\n**In practice.** The framework includes an information security management system based on recognised standards, a digital operational resilience strategy setting out ICT risk tolerance, objectives, key performance indicators and the approach to third-party risk, and clear segregation between ICT risk management, control and internal audit functions. A control function with appropriate independence is assigned responsibility for ICT risk. The framework is reviewed at least yearly, after major ICT-related incidents and following supervisory findings, and the review report is provided to the competent authority on request. Internal audit reviews it regularly, with formal follow-up of findings. Evidence includes approved policies, review reports, audit plans and the strategy document.\n\n**Common gaps.** Gaps include frameworks that exist on paper without measurable tolerance levels, weak independence of the control function, and audit findings without tracked remediation.",null,"https:\u002F\u002Feur-lex.europa.eu\u002Flegal-content\u002FEN\u002FTXT\u002FHTML\u002F?uri=CELEX:32022R2554#art_6","Read the official text on EUR-Lex","2026-10-18T15:18:43.664+00:00",{"total":9,"list":17},[],[],[]]