Knowledge · DORA · Article 6
One documented framework – reviewed every year.
Financial entities must have a sound, comprehensive and well-documented ICT risk-management framework as part of their overall risk management. It is reviewed at least once a year and put into practice through a digital operational resilience strategy.
What it requires
In plain words.
- A documented framework of strategies, policies, procedures, ICT protocols and tools that protects all information and ICT assets
- Responsibility for managing and overseeing ICT risk sits with a control function that has appropriate independence
- The framework is reviewed at least once a year, after major ICT-related incidents and after findings from supervisors, testing or audits
- Internal auditors audit the framework regularly, and critical findings are formally followed up
- A digital operational resilience strategy sets out risk tolerance, security objectives with key indicators and how incidents are detected
Plain-language summary of DORA Article 6 (Regulation (EU) 2022/2554). Not legal advice – read the official text on EUR-Lex.
In practice
What it takes.
A framework is not a folder of documents. Each policy needs an owner, a review date and a link to the Controls and evidence that show it works.
- PoliciesEvery policy with an owner, a version and a review date
- ProcessA yearly review and a review after major incidents, with approvals logged
- ControlsControls mapped to the framework, with evidence attached
- ReportsAudit findings tracked until closed, with status for management
How it runs in Paragraf – on the same foundation as your contracts and processes.
Next step
See DORA article 6
with your own requirements.
Book a walkthrough. We show you the thread from this article to the Control, the owner and the evidence – in your own setup.