Art.6 ICT risk management framework

Financial entities keep a sound, comprehensive and documented ICT risk management framework within their overall risk management system, covering the strategies, policies, procedures, protocols and tools that protect information and ICT assets and physical infrastructure, and including a digital operational resilience strategy (risk tolerance, security objectives, reference architecture, detection, testing and incident communication). The framework is reviewed yearly as a minimum (a microenterprise may instead set its own periodic cycle), and also after major ICT-related incidents and after supervisory instructions or test and audit conclusions, with a review report available to the competent authority on request (Art. 6(5)). Entities other than microenterprises assign ICT risk to an independent control function (Art. 6(4)) and subject the framework to regular internal audit by auditors with ICT expertise and independence, followed by a formal process to remediate critical findings (Art. 6(6) and (7)); microenterprises are outside the internal-audit duty. Applied in proportion to size, risk profile and complexity under Article 4(1). Entities listed in Article 16(1) are outside this Article and follow the simplified framework of Article 16 instead.

Source: DORA (Regulation (EU) 2022/2554), Art.6. The statement above is our statement of the clause, read from the published text and cited so you can check it against the official text, not the instrument verbatim. Open DORA (Regulation (EU) 2022/2554) in the compliance library.

Applies to the financial entities listed in Article 2. Many duties are lighter or absent for microenterprises and for the entities in Article 16(1); each statement says where. Article 19 carries the reporting clocks of Delegated Regulation (EU) 2025/301, Article 5.