Knowledge · DORA · Article 5
The board owns ICT risk – and must understand it.
The management body defines, approves and oversees the ICT risk-management framework and bears ultimate responsibility for ICT risk. Its members must keep their knowledge up to date, including through regular training.
What it requires
In plain words.
- Management bears ultimate responsibility for managing ICT risk
- Management approves the digital operational resilience strategy and sets clear roles and responsibilities for ICT
- Management approves and reviews the ICT business continuity policy, the response and recovery plans and the internal ICT audit plans
- Management allocates and reviews the budget for digital operational resilience
- Management approves the policy on ICT third-party services and is informed of arrangements, material changes and major incidents
- Members keep sufficient knowledge and skills on ICT risk, including through regular training
Plain-language summary of DORA Article 5 (Regulation (EU) 2022/2554). Not legal advice – read the official text on EUR-Lex.
In practice
What it takes.
Responsibility has to be traceable to decisions – who approved what, when and on what basis. And training has to be recorded per board member, not assumed.
- ControlsOne Control per management duty, owned by the board or the CEO
- ProcessA yearly cycle to approve strategy, policies, plans and budget
- TrainingICT risk training for board members, with a knowledge test
- EvidenceSigned decisions and completed training, kept with each Control
How it runs in Paragraf – on the same foundation as your contracts and processes.
Next step
See DORA article 5
with your own requirements.
Book a walkthrough. We show you the thread from this article to the Control, the owner and the evidence – in your own setup.