DORA ICT Risk Management Framework (Articles 5–16): Requirements

Article Map (Themes)

• Art. 5–6 — governance, ICT risk management framework, and related responsibilities
• Art. 7 — ICT systems, protocols and tools proportionate to risks
• Art. 8 — identification of ICT assets and dependencies
• Art. 9 — protection and prevention
• Art. 10 — detection — logging & SIEM evidence
• Art. 11–12 — response and recovery; backup policies and restoration procedures (including recovery objectives set by the entity)
• Art. 13–14 — learning and evolution; crisis communication
• Art. 15–16 — further implementing / simplified ICT risk management themes as applicable

Management-Body Expectation

Boards must approve and oversee the ICT risk management framework — not treat it as a purely technical CISO document. Annual review cadences and residual-risk acceptance belong in governance packs.

RTO / RPO Note

Backup and restoration strategies reference recovery time and recovery point objectives. Specific hours or minutes are organisation-specific — derived from business impact analysis and critical-function mapping, not from a universal DORA number.

How CyberSilo Helps

• Pillar-by-pillar evidence maps in CSA for DORA
• Detection and major-incident timelines with ThreatHawk SIEM
• Advisory scoping — contact CyberSilo

Frequently Asked Questions

Which articles cover the ICT risk framework?

Articles 5–16 of Regulation (EU) 2022/2554 set out the ICT risk management framework themes from governance through detection, response, backup, learning, and communication.

Does DORA prescribe a single RTO number?

No. Recovery objectives are set by the financial entity based on critical functions and impact analysis — there is no universal RTO/RPO number in DORA.

How does this relate to ISO 27001?

ISO 27001 can support many control themes, but DORA still requires financial-sector-specific governance, reporting, testing, and third-party artefacts — see DORA vs ISO 27001.

Related DORA Resources

Hub · Checklist · CSA