DORA requirements for an ICT risk management framework
Domain scope
This domain tests the governance and process requirements for an ICT risk management framework under DORA: management-body accountability, documented policies, asset and dependency identification, protection, detection, response and recovery, backup, learning, and communication. Expect questions on who approves what and which framework element is missing in a scenario.
Core rules and concepts
- The management body defines the ICT risk appetite, approves the ICT strategy and framework, and remains accountable; it cannot outsource accountability to IT or a provider.
- The framework must be documented and proportionate, covering strategies, policies, procedures, protocols and tools to protect all information and ICT assets.
- It must support identification and classification of ICT assets, business functions and dependencies, including links to critical or important functions.
- It must include protection and prevention, detection, response and recovery, backup and restoration, and learning from incidents.
- The framework is reviewed at least annually and after major ICT-related incidents; internal audit provides independent review.
- Crisis communication, training and awareness are part of the framework, not optional extras.
Worked example
A firm has an approved ICT policy but no inventory of the servers supporting its payment service. The gap is asset identification and dependency mapping. Without knowing which assets support a critical function, the firm cannot classify risk, set recovery priorities, or prove its continuity plans are adequate. The fix is not a new policy; it is an inventory with owners, classification, dependencies and regular updates, then risk assessment and treatment tied to that inventory.
Traps that cost marks
Do not say the framework is only an IT-department document; do not treat annual review as the only trigger; do not claim outsourcing removes responsibility; and do not confuse proportionality with full exemption. A common error is naming backup or testing as the whole framework rather than one component.