Fundamental concepts of ICT risk management and digital operational resilience
Domain scope
This domain tests whether you can use DORA's vocabulary precisely and connect concepts: ICT risk, digital operational resilience, critical or important functions, ICT-related incidents and major incidents. Expect definitional questions and short scenarios, not article-number recall.
Core rules and concepts
- ICT risk is the risk of loss or disruption from the failure, misuse, or compromise of ICT systems, including availability, integrity, confidentiality and authenticity failures.
- Digital operational resilience is the ability to build, maintain and improve IT security and withstand all types of ICT disruption, not only cyberattacks.
- Critical or important functions are functions whose disruption materially impairs financial performance, soundness, or continuity of services. The label is not applied to every process.
- ICT-related incident is an actual adverse event in the network or information system. A major incident meets DORA's severity criteria, such as clients affected, duration, geographic spread, data loss, criticality and economic impact.
- Proportionality lets smaller or less risky entities apply simpler arrangements, but it does not exempt them from DORA's core obligations. DORA rests on five policy pillars: ICT risk management, incident reporting, resilience testing, ICT third-party risk and information sharing.
Worked example
A phishing email compromises a payment team's mailbox. This is an ICT-related incident because an actual adverse event affected an information system. Is it major? Check severity: if the mailbox gave access to payment instructions and caused a two-hour outage for many clients, the duration, client impact and criticality may make it major. A single blocked phishing email with no compromise is not an incident of the same kind, and not every incident is reportable as major.
Traps that cost marks
Do not equate digital operational resilience with disaster recovery only; do not treat outsourcing as transferring accountability; do not call every business function critical; and do not assume DORA covers only cybersecurity. Also avoid saying all ICT incidents are major or reportable.