ICT risk management
Also called ICT risk management framework, technology risk management
ICT risk management is how a financial firm identifies, protects against, detects, responds to and recovers from risks to its information and communication technology. Under the EU's Digital Operational Resilience Act, it is a documented framework owned by the management body and covering systems, data, people and third-party providers.
How it works
A firm maps its ICT assets and the business functions they support, then assesses threats and vulnerabilities. It sets controls such as access management, encryption, patching and network segmentation, and monitors for anomalies. Response and recovery plans, backups and testing limit the damage from incidents. The framework is reviewed at least yearly and after major incidents, and audited internally.
Banks, insurers and investment firms depend on technology for almost every service, and many rely on the same cloud and software providers. A cyber attack or outage can stop payments or trading. DORA made ICT risk management a binding EU requirement from January 2025, with a simplified regime for smaller firms. The management body holds ultimate responsibility.
The rules
Requires a documented ICT risk management framework under management body responsibility, reviewed at least once a year.
Banks, insurers, investment firms, payment firms and other EU financial entitiesSpecifies the policies, procedures and tools required, and a simplified framework for smaller entities.
Financial entities in scope of DORACommon questions
Who is responsible for ICT risk management under DORA?
The management body. DORA makes it ultimately responsible for managing ICT risk, approving the framework and allocating the budget. Firms also assign a control function to oversee ICT risk.
Does ICT risk management cover third-party providers?
Yes. DORA treats ICT third-party risk as part of ICT risk management. Firms keep a register of information on ICT contracts and assess risks from providers before and during the relationship.
Do small firms face the same requirements?
No. Smaller and non-interconnected investment firms and certain other entities apply a simplified ICT risk management framework under Article 16 of DORA, with detail set out in the RTS.
