DORA, förordning (EU) 2022/2554 · gäller från 2025-01-17
Styrning och IKT-riskram, DORA art. 5–6
Ledningsorganet bär det yttersta ansvaret för IKT-risken, godkänner riskramen och budgeten och ska ha egen kunskap. Riskramen ska vara dokumenterad, ha en oberoende kontrollfunktion och ses över minst en gång per år.
Krav
Art. 5(1) Internal governance and control framework for ICT risk
Financial entities shall have in place an internal governance and control framework that ensures an effective and prudent management of ICT risk, in accordance with Article 6(4), in order to achieve a high level of digital operational resilience.
Art. 5(2) Management body defines, approves and oversees the ICT risk framework
The management body of the financial entity shall define, approve, oversee and be responsible for the implementation of all arrangements related to the ICT risk management framework referred to in Article 6(1).
Art. 5(2)(a) Ultimate responsibility for ICT risk
bear the ultimate responsibility for managing the financial entity’s ICT risk;
Art. 5(2)(g) Budget for digital operational resilience
allocate and periodically review the appropriate budget to fulfil the financial entity’s digital operational resilience needs in respect of all types of resources, including relevant ICT security awareness programmes and digital operational resilience training referred to in Article 13(6), and ICT skills for all staff;
Art. 5(4) Management body ICT knowledge and training
Members of the management body of the financial entity shall actively keep up to date with sufficient knowledge and skills to understand and assess ICT risk and its impact on the operations of the financial entity, including by following specific training on a regular basis, commensurate to the ICT risk being managed.
Art. 6(1) Sound, comprehensive and well-documented ICT risk framework
Financial entities shall have a sound, comprehensive and well-documented ICT risk management framework as part of their overall risk management system, which enables them to address ICT risk quickly, efficiently and comprehensively and to ensure a high level of digital operational resilience.
Art. 6(4) Independent ICT risk control function
Financial entities, other than microenterprises, shall assign the responsibility for managing and overseeing ICT risk to a control function and ensure an appropriate level of independence of such control function in order to avoid conflicts of interest.
Art. 6(5) Annual review of the ICT risk framework
The ICT risk management framework shall be documented and reviewed at least once a year, or periodically in the case of microenterprises, as well as upon the occurrence of major ICT-related incidents, and following supervisory instructions or conclusions derived from relevant digital operational resilience testing or audit processes.
Frister
Riskramen ses över minst en gång per år, efter allvarliga IKT-incidenter och efter tillsynens anvisningar (art. 6.5).
Sanktioner
Art. 50(3)–(4): varje medlemsstat fastställer administrativa sanktioner och åtgärder. Det finns inget gemensamt EU-belopp.
Art. 35(6)–(8): kritiska IKT-leverantörer kan få vite på upp till 1 procent av genomsnittlig daglig global omsättning, i högst sex månader.
No DORA sanction decision with an official public source is in the register yet (DORA applies from 2025-01-17); status not_in_register.
Vem omfattas
Finansiella företag enligt art. 2.1 a–t (20 typer), bland annat banker, betalinstitut, försäkringsbolag, fondbolag, värdepappersbolag och kryptotjänstleverantörer. Spelbolag omfattas inte om de inte också har ett sådant tillstånd.
- Agent:
- agent:eu:dora:agent-dora-art-5-6
- Källa:
- EUR-Lex, läst 2026-10-10
- Noder:
- /graf/dora
Kontrollkopplingar och kopplingar till GDPR, SEC och CCPA finns i NovaCopilot med partnernyckel. Source: NovaCopilot.