--- title: "Article 6 — ICT risk management framework" type: regulation legal_status: in_force source: "https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX%3A32022R2554" shortTitle: "Article 6 — ICT risk management framework" instrument_type: level1_regulation authority: Commission binding: true binding_character: binding mica_level2: false legal_basis: "Regulation (EU) 2022/2554" instrument: dora celex: "32022R2554" regulation: DORA regulation-full: "Regulation (EU) 2022/2554" article: 6 status: in_force text_version: "Regulation (EU) 2022/2554, OJ L 333, 27.12.2022" source_url: "https://eur-lex.europa.eu/eli/reg/2022/2554/oj/eng" check_status: matched verified: true last_checked: 2026-11-09 --- *In force · Regulation (EU) 2022/2554, OJ L 333, 27.12.2022 · Verified 9 Nov 2026 · [Official source](https://eur-lex.europa.eu/eli/reg/2022/2554/oj/eng)* 1. Financial entities shall have a sound, comprehensive and well-documented [ICT risk](https://www.headlesslaw.com/definitions/dora/ict-risk) management framework as part of their overall risk management system, which enables them to address [ICT risk](https://www.headlesslaw.com/definitions/dora/ict-risk) quickly, efficiently and comprehensively and to ensure a high level of [digital operational resilience](https://www.headlesslaw.com/definitions/dora/digital-operational-resilience). 2. The [ICT risk](https://www.headlesslaw.com/definitions/dora/ict-risk) management framework shall include at least strategies, policies, procedures, ICT protocols and tools that are necessary to duly and adequately protect all [information assets](https://www.headlesslaw.com/definitions/dora/information-asset) and [ICT assets](https://www.headlesslaw.com/definitions/dora/ict-asset), including computer software, hardware, servers, as well as to protect all relevant physical components and infrastructures, such as premises, data centres and sensitive designated areas, to ensure that all [information assets](https://www.headlesslaw.com/definitions/dora/information-asset) and [ICT assets](https://www.headlesslaw.com/definitions/dora/ict-asset) are adequately protected from risks including damage and unauthorised access or usage. 3. In accordance with their [ICT risk](https://www.headlesslaw.com/definitions/dora/ict-risk) management framework, financial entities shall minimise the impact of [ICT risk](https://www.headlesslaw.com/definitions/dora/ict-risk) by deploying appropriate strategies, policies, procedures, ICT protocols and tools. They shall provide complete and updated information on [ICT risk](https://www.headlesslaw.com/definitions/dora/ict-risk) and on their [ICT risk](https://www.headlesslaw.com/definitions/dora/ict-risk) management framework to the competent authorities upon their request. 4. Financial entities, other than [microenterprises](https://www.headlesslaw.com/definitions/dora/microenterprise), shall assign the responsibility for managing and overseeing [ICT risk](https://www.headlesslaw.com/definitions/dora/ict-risk) to a control function and ensure an appropriate level of independence of such control function in order to avoid conflicts of interest. Financial entities shall ensure appropriate segregation and independence of [ICT risk](https://www.headlesslaw.com/definitions/dora/ict-risk) management functions, control functions, and internal audit functions, according to the three lines of defence model, or an internal risk management and control model. 5. The [ICT risk](https://www.headlesslaw.com/definitions/dora/ict-risk) management framework shall be documented and reviewed at least once a year, or periodically in the case of [microenterprises](https://www.headlesslaw.com/definitions/dora/microenterprise), as well as upon the occurrence of [major ICT-related incidents](https://www.headlesslaw.com/definitions/dora/major-ict-related-incident), and following supervisory instructions or conclusions derived from relevant [digital operational resilience](https://www.headlesslaw.com/definitions/dora/digital-operational-resilience) testing or audit processes. It shall be continuously improved on the basis of lessons derived from implementation and monitoring. A report on the review of the [ICT risk](https://www.headlesslaw.com/definitions/dora/ict-risk) management framework shall be submitted to the competent authority upon its request. 6. The [ICT risk](https://www.headlesslaw.com/definitions/dora/ict-risk) management framework of financial entities, other than [microenterprises](https://www.headlesslaw.com/definitions/dora/microenterprise), shall be subject to internal audit by auditors on a regular basis in line with the financial entities’ audit plan. Those auditors shall possess sufficient knowledge, skills and expertise in [ICT risk](https://www.headlesslaw.com/definitions/dora/ict-risk), as well as appropriate independence. The frequency and focus of ICT audits shall be commensurate to the [ICT risk](https://www.headlesslaw.com/definitions/dora/ict-risk) of the financial entity. 7. Based on the conclusions from the internal audit review, financial entities shall establish a formal follow-up process, including rules for the timely verification and remediation of critical ICT audit findings. 8. The [ICT risk](https://www.headlesslaw.com/definitions/dora/ict-risk) management framework shall include a [digital operational resilience](https://www.headlesslaw.com/definitions/dora/digital-operational-resilience) strategy setting out how the framework shall be implemented. To that end, the [digital operational resilience](https://www.headlesslaw.com/definitions/dora/digital-operational-resilience) strategy shall include methods to address [ICT risk](https://www.headlesslaw.com/definitions/dora/ict-risk) and attain specific ICT objectives, by: **(a)** explaining how the [ICT risk](https://www.headlesslaw.com/definitions/dora/ict-risk) management framework supports the financial entity’s business strategy and objectives; **(b)** establishing the risk tolerance level for [ICT risk](https://www.headlesslaw.com/definitions/dora/ict-risk), in accordance with the risk appetite of the financial entity, and analysing the impact tolerance for ICT disruptions; **(c)** setting out clear information security objectives, including key performance indicators and key risk metrics; **(d)** explaining the ICT reference architecture and any changes needed to reach specific business objectives; **(e)** outlining the different mechanisms put in place to detect [ICT-related incidents](https://www.headlesslaw.com/definitions/dora/ict-related-incident), prevent their impact and provide protection from it; **(f)** evidencing the current [digital operational resilience](https://www.headlesslaw.com/definitions/dora/digital-operational-resilience) situation on the basis of the number of [major ICT-related incidents](https://www.headlesslaw.com/definitions/dora/major-ict-related-incident) reported and the effectiveness of preventive measures; **(g)** implementing [digital operational resilience](https://www.headlesslaw.com/definitions/dora/digital-operational-resilience) testing, in accordance with Chapter IV of this Regulation; **(h)** outlining a communication strategy in the event of [ICT-related incidents](https://www.headlesslaw.com/definitions/dora/ict-related-incident) the disclosure of which is required in accordance with [Article 14](14.md). 9. Financial entities may, in the context of the [digital operational resilience](https://www.headlesslaw.com/definitions/dora/digital-operational-resilience) strategy referred to in paragraph 8, define a holistic ICT multi-vendor strategy, at [group](https://www.headlesslaw.com/definitions/dora/group) or entity level, showing key dependencies on [ICT third-party service providers](https://www.headlesslaw.com/definitions/dora/ict-third-party-service-provider) and explaining the rationale behind the procurement mix of [ICT third-party service providers](https://www.headlesslaw.com/definitions/dora/ict-third-party-service-provider). 10. Financial entities may, in accordance with Union and national sectoral law, outsource the tasks of verifying compliance with [ICT risk](https://www.headlesslaw.com/definitions/dora/ict-risk) management requirements to intra-group or external undertakings. In case of such outsourcing, the financial entity remains fully responsible for the verification of compliance with the [ICT risk](https://www.headlesslaw.com/definitions/dora/ict-risk) management requirements. *** [Chapter II — ICT risk management](../chapters/ii.md) › Section II · [← Article 5](5.md) · [Article 7 →](7.md)