<!-- headlesslaw {"release":{"id":"a4f2a0495fe55b47323883f82977a9b34ab66171ec9623e39925d3a7045b6c81","published":"2026-11-01T16:41:30Z","pinned":false},"limits":{"coverage":{"history":"full","held_since":"2022-12-27","gaps":[],"covered":["DORA L1"],"not_covered":["national guidance","court decisions"]},"freshness":{"release_id":"a4f2a0495fe55b47323883f82977a9b34ab66171ec9623e39925d3a7045b6c81","release_published":"2026-11-01T16:41:30Z","checked_at":"2026-10-26","checked_against":"EUR-Lex"},"truncation":null,"failures":[],"incomplete":[]},"page":{"path":"/dora/recitals/47","url":"https://www.headlesslaw.com/dora/recitals/47","title":"Recital 47","family":"l1_recital_view","work_id":"dora","view_of":"/dora/recitals","status":"in_force","force_status":"in_force","date_state":"current","requested_date":null,"as_of":"2026-11-01","applies_from":null,"application":null,"version_label":"Regulation (EU) 2022/2554, OJ L 333, 27.12.2022","check":{"against":"EUR-Lex","on":"2026-10-26"},"check_result":"matched","official_url":"https://eur-lex.europa.eu/eli/reg/2022/2554/oj/eng","valid_from":"2022-12-27","valid_until":null,"content_id":"0a8bff1abcf65c1f","versions":["2022-12-27"],"version_url":"https://www.headlesslaw.com/dora/recitals/47/versions/2022-12-27","revision_url":"https://www.headlesslaw.com/dora/recitals/47/versions/2022-12-27/rev/0a8bff1abcf65c1f","versions_url":"https://www.headlesslaw.com/dora/recitals/47/versions","relations_url":"https://www.headlesslaw.com/dora/recitals/47/relations","act_url":"https://www.headlesslaw.com/dora/recitals","source_line":null,"attribution":null,"context":{"act":{"work_id":"dora","path":"/dora/recitals","name":"DORA","number":"Regulation (EU) 2022/2554","celex":"32022R2554","title_official":null,"document_date":null},"position":{"kind":"recital","key":"47","index":47,"articles":106,"annexes":0},"prev":{"path":"/dora/recitals/46","key":"46","title":"Recital 46"},"next":{"path":"/dora/recitals/48","key":"48","title":"Recital 48"},"act_anchor":""}}} -->
# Recital 47

*In force · Regulation (EU) 2022/2554, OJ L 333, 27.12.2022 · Checked against EUR-Lex on 26 Oct 2026 · [Official source](https://eur-lex.europa.eu/eli/reg/2022/2554/oj/eng)*

Inspired by relevant international, national and industry best practices, guidelines, recommendations and approaches to the management of cyber risk, this Regulation promotes a set of principles that facilitate the overall structure of ICT risk management. Consequently, as long as the main capabilities which financial entities put in place address the various functions in the ICT risk management (identification, protection and prevention, detection, response and recovery, learning and evolving and communication) set out in this Regulation, financial entities should remain free to use ICT risk management models that are differently framed or categorised.