--- title: "Article 5 — Governance and organisation" type: regulation legal_status: in_force source: "https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX%3A32022R2554" shortTitle: "Article 5 — Governance and organisation" instrument_type: level1_regulation authority: Commission binding: true binding_character: binding mica_level2: false legal_basis: "Regulation (EU) 2022/2554" instrument: dora celex: "32022R2554" regulation: DORA regulation-full: "Regulation (EU) 2022/2554" article: 5 status: in_force text_version: "Regulation (EU) 2022/2554, OJ L 333, 27.12.2022" source_url: "https://eur-lex.europa.eu/eli/reg/2022/2554/oj/eng" check_status: matched verified: true last_checked: 2026-11-09 --- *In force · Regulation (EU) 2022/2554, OJ L 333, 27.12.2022 · Verified 9 Nov 2026 · [Official source](https://eur-lex.europa.eu/eli/reg/2022/2554/oj/eng)* 1. Financial entities shall have in place an internal governance and control framework that ensures an effective and prudent management of [ICT risk](https://www.headlesslaw.com/definitions/dora/ict-risk), in accordance with [Article 6(4)](6.md), in order to achieve a high level of [digital operational resilience](https://www.headlesslaw.com/definitions/dora/digital-operational-resilience). 2. The [management body](https://www.headlesslaw.com/definitions/dora/management-body) of the financial entity shall define, approve, oversee and be responsible for the implementation of all arrangements related to the [ICT risk](https://www.headlesslaw.com/definitions/dora/ict-risk) management framework referred to in [Article 6(1)](6.md). For the purposes of the first subparagraph, the [management body](https://www.headlesslaw.com/definitions/dora/management-body) shall: **(a)** bear the ultimate responsibility for managing the financial entity’s [ICT risk](https://www.headlesslaw.com/definitions/dora/ict-risk); **(b)** put in place policies that aim to ensure the maintenance of high standards of availability, authenticity, integrity and confidentiality, of data; **(c)** set clear roles and responsibilities for all ICT-related functions and establish appropriate governance arrangements to ensure effective and timely communication, cooperation and coordination among those functions; **(d)** bear the overall responsibility for setting and approving the [digital operational resilience](https://www.headlesslaw.com/definitions/dora/digital-operational-resilience) strategy as referred to in [Article 6(8)](6.md), including the determination of the appropriate risk tolerance level of [ICT risk](https://www.headlesslaw.com/definitions/dora/ict-risk) of the financial entity, as referred to in [Article 6(8), point (b)](6.md); **(e)** approve, oversee and periodically review the implementation of the financial entity’s ICT business continuity policy and ICT response and recovery plans, referred to, respectively, in [Article 11(1)](11.md) and (3), which may be adopted as a dedicated specific policy forming an integral part of the financial entity’s overall business continuity policy and response and recovery plan; **(f)** approve and periodically review the financial entity’s ICT internal audit plans, ICT audits and material modifications to them; **(g)** allocate and periodically review the appropriate budget to fulfil the financial entity’s [digital operational resilience](https://www.headlesslaw.com/definitions/dora/digital-operational-resilience) needs in respect of all types of resources, including relevant ICT security awareness programmes and [digital operational resilience](https://www.headlesslaw.com/definitions/dora/digital-operational-resilience) training referred to in [Article 13(6)](13.md), and ICT skills for all staff; **(h)** approve and periodically review the financial entity’s policy on arrangements regarding the use of [ICT services](https://www.headlesslaw.com/definitions/dora/ict-services) provided by [ICT third-party service providers](https://www.headlesslaw.com/definitions/dora/ict-third-party-service-provider); **(i)** put in place, at corporate level, reporting channels enabling it to be duly informed of the following: **(i)** arrangements concluded with [ICT third-party service providers](https://www.headlesslaw.com/definitions/dora/ict-third-party-service-provider) on the use of [ICT services](https://www.headlesslaw.com/definitions/dora/ict-services), **(ii)** any relevant planned material changes regarding the [ICT third-party service providers](https://www.headlesslaw.com/definitions/dora/ict-third-party-service-provider), **(iii)** the potential impact of such changes on the [critical or important functions](https://www.headlesslaw.com/definitions/dora/critical-or-important-function) subject to those arrangements, including a risk analysis summary to assess the impact of those changes, and at least [major ICT-related incidents](https://www.headlesslaw.com/definitions/dora/major-ict-related-incident) and their impact, as well as response, recovery and corrective measures. 3. Financial entities, other than [microenterprises](https://www.headlesslaw.com/definitions/dora/microenterprise), shall establish a role in order to monitor the arrangements concluded with [ICT third-party service providers](https://www.headlesslaw.com/definitions/dora/ict-third-party-service-provider) on the use of [ICT services](https://www.headlesslaw.com/definitions/dora/ict-services), or shall designate a member of senior management as responsible for overseeing the related risk exposure and relevant documentation. 4. Members of the [management body](https://www.headlesslaw.com/definitions/dora/management-body) of the financial entity shall actively keep up to date with sufficient knowledge and skills to understand and assess [ICT risk](https://www.headlesslaw.com/definitions/dora/ict-risk) and its impact on the operations of the financial entity, including by following specific training on a regular basis, commensurate to the [ICT risk](https://www.headlesslaw.com/definitions/dora/ict-risk) being managed. *** [Chapter II — ICT risk management](../chapters/ii.md) › Section I · [← Article 4](4.md) · [Article 6 →](6.md)