{"attribution":{"source":"legal.exploreworldai.com","canonical":"https://legal.exploreworldai.com/api/public/v1/article-agent?id=agent%3Aeu%3Adora%3Aart-6","cite_as":"NovaCopilot, legal.exploreworldai.com (https://legal.exploreworldai.com/api/public/v1/article-agent?id=agent%3Aeu%3Adora%3Aart-6)","license":"https://legal.exploreworldai.com/revision","version":"legal-2026-11-02","fingerprint":"ewai:eu:ce0366","proof":"sha256:360be70b05a7f8ca11cb6b0ecfc095860768be35dc8ddc5eb9c6c88699bf04e2","jurisdiction":"eu","publisher":"NovaCopilot by ExploreWorld Legal","terms":"https://legal.exploreworldai.com/om"},"brand_source":"Source: NovaCopilot","object_type":"article_agent","schema_version":"1.0.0","id":"agent:eu:dora:art-6","act":"dora-2022-2554","article":"6","text_sha256":"91bf28528f2f64d55e4a513a432b23f23a32b4f21f9aafa7e1406a5ed416665c","obligations":["obligation:eu:dora-2022-2554-art-6-financial-entity"],"agent":"agent:eu:dora","name":"NovaCopilot DORA Agent, Article 6","title":{"en":"ICT risk management framework","sv":"IKT-riskhanteringsram","de":"IKT-Risikomanagementrahmen"},"text":{"lang":"en","paragraphs":["1. Financial entities shall have a sound, comprehensive and well-documented ICT risk management framework as part of their overall risk management system, which enables them to address ICT risk quickly, efficiently and comprehensively and to ensure a high level of digital operational resilience.","2. The ICT risk management framework shall include at least strategies, policies, procedures, ICT protocols and tools that are necessary to duly and adequately protect all information assets and ICT assets, including computer software, hardware, servers, as well as to protect all relevant physical c …","3. In accordance with their ICT risk management framework, financial entities shall minimise the impact of ICT risk by deploying appropriate strategies, policies, procedures, ICT protocols and tools. They shall provide complete and updated information on ICT risk and on their ICT risk management framework to the competent authorities upon their request.","4. Financial entities, other than microenterprises, shall assign the responsibility for managing and overseeing ICT risk to a control function and ensure an appropriate level of independence of such control function in order to avoid conflicts of interest. Financial entities shall ensure appropriate …","5. The ICT risk management framework shall be documented and reviewed at least once a year, or periodically in the case of microenterprises, as well as upon the occurrence of major ICT-related incidents, and following supervisory instructions or conclusions derived from relevant digital operational …","6. The ICT risk management framework of financial entities, other than microenterprises, shall be subject to internal audit by auditors on a regular basis in line with the financial entities’ audit plan. Those auditors shall possess sufficient knowledge, skills and expertise in ICT risk, as well as appropriate independence. The frequency and focus of ICT audits shall be commensurate to the ICT risk of the financial entity.","7. Based on the conclusions from the internal audit review, financial entities shall establish a formal follow-up process, including rules for the timely verification and remediation of critical ICT audit findings.","8. The ICT risk management framework shall include a digital operational resilience strategy setting out how the framework shall be implemented. To that end, the digital operational resilience strategy shall include methods to address ICT risk and attain specific ICT objectives, by:","(a)","explaining how the ICT risk management framework supports the financial entity’s business strategy and objectives;","(b)","establishing the risk tolerance level for ICT risk, in accordance with the risk appetite of the financial entity, and analysing the impact tolerance for ICT disruptions;","(c)","setting out clear information security objectives, including key performance indicators and key risk metrics;"],"source_url":"https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX%3A32022R2554","read_at":"2026-08-18"},"sha256":"f8e6bc91d6181382932951f201b28f63026e8c8f5679795a2170bd900564bc7f","duties":[{"id":"obligation:eu:dora-2022-2554-art-6-financial-entity","role":"financial-entity","duty":"Maintain a sound, comprehensive and documented ICT risk management framework."}],"applies_to_role":{"status":"verified","roles":["financial-entity"],"entity_types":[{"role":"credit-institution","parent_role":"financial-entity","article":"2(1)(a)"},{"role":"payment-institution","parent_role":"financial-entity","article":"2(1)(b)"},{"role":"account-information-service-provider","parent_role":"financial-entity","article":"2(1)(c)"},{"role":"electronic-money-institution","parent_role":"financial-entity","article":"2(1)(d)"},{"role":"investment-firm","parent_role":"financial-entity","article":"2(1)(e)"},{"role":"crypto-asset-service-provider","parent_role":"financial-entity","article":"2(1)(f)"},{"role":"central-securities-depository","parent_role":"financial-entity","article":"2(1)(g)"},{"role":"central-counterparty","parent_role":"financial-entity","article":"2(1)(h)"},{"role":"trading-venue","parent_role":"financial-entity","article":"2(1)(i)"},{"role":"trade-repository","parent_role":"financial-entity","article":"2(1)(j)"},{"role":"aifm","parent_role":"financial-entity","article":"2(1)(k)"},{"role":"management-company","parent_role":"financial-entity","article":"2(1)(l)"},{"role":"data-reporting-service-provider","parent_role":"financial-entity","article":"2(1)(m)"},{"role":"insurer","parent_role":"financial-entity","article":"2(1)(n)"},{"role":"insurance-intermediary","parent_role":"financial-entity","article":"2(1)(o)"},{"role":"iorp","parent_role":"financial-entity","article":"2(1)(p)"},{"role":"credit-rating-agency","parent_role":"financial-entity","article":"2(1)(q)"},{"role":"critical-benchmark-administrator","parent_role":"financial-entity","article":"2(1)(r)"},{"role":"crowdfunding-service-provider","parent_role":"financial-entity","article":"2(1)(s)"},{"role":"securitisation-repository","parent_role":"financial-entity","article":"2(1)(t)"}]},"applies_to_industry":{"status":"derived","industries":["banking","insurance"]},"cross_industry_chains":{"status":"verified","shape":"rule → obligation → control → industry","chains":[{"id":"chain:dora~dora-art.-6","rule":"dora","obligation":"ICT risk management framework","control":"DORA art. 6","industries":["financial-services","insurance","technology"],"entity_types":[{"role":"credit-institution","label":"Credit institutions","article":"DORA art. 2(1)(a)"},{"role":"payment-institution","label":"Payment institutions","article":"DORA art. 2(1)(b)"},{"role":"account-information-service-provider","label":"Account information service providers","article":"DORA art. 2(1)(c)"},{"role":"electronic-money-institution","label":"Electronic money institutions","article":"DORA art. 2(1)(d)"},{"role":"investment-firm","label":"Investment firms","article":"DORA art. 2(1)(e)"},{"role":"crypto-asset-service-provider","label":"Crypto-asset service providers and issuers of asset-referenced tokens","article":"DORA art. 2(1)(f)"},{"role":"central-securities-depository","label":"Central securities depositories","article":"DORA art. 2(1)(g)"},{"role":"central-counterparty","label":"Central counterparties","article":"DORA art. 2(1)(h)"},{"role":"trading-venue","label":"Trading venues","article":"DORA art. 2(1)(i)"},{"role":"trade-repository","label":"Trade repositories","article":"DORA art. 2(1)(j)"},{"role":"aifm","label":"Managers of alternative investment funds","article":"DORA art. 2(1)(k)"},{"role":"management-company","label":"Management companies","article":"DORA art. 2(1)(l)"},{"role":"data-reporting-service-provider","label":"Data reporting service providers","article":"DORA art. 2(1)(m)"},{"role":"insurer","label":"Insurance and reinsurance undertakings","article":"DORA art. 2(1)(n)"},{"role":"insurance-intermediary","label":"Insurance intermediaries, reinsurance intermediaries and ancillary insurance intermediaries","article":"DORA art. 2(1)(o)"},{"role":"iorp","label":"Institutions for occupational retirement provision","article":"DORA art. 2(1)(p)"},{"role":"credit-rating-agency","label":"Credit rating agencies","article":"DORA art. 2(1)(q)"},{"role":"critical-benchmark-administrator","label":"Administrators of critical benchmarks","article":"DORA art. 2(1)(r)"},{"role":"crowdfunding-service-provider","label":"Crowdfunding service providers","article":"DORA art. 2(1)(s)"},{"role":"securitisation-repository","label":"Securitisation repositories","article":"DORA art. 2(1)(t)"},{"role":"ict-third-party-service-provider","label":"ICT third-party service providers","article":"DORA art. 2(1)(u)"}]}]},"revenue_exposure":{"status":"not_in_register","reason":"member_state_penalties","sanction_article":"50","source_url":"https://eur-lex.europa.eu/eli/reg/2022/2554/oj","via":"article 50"},"links":{"article_page":"https://legal.exploreworldai.com/eu/rattsakter/dora-2022-2554/artikel-6","regulation_agent":"https://legal.exploreworldai.com/api/public/v1/article-agents?reg=dora","changes":"https://legal.exploreworldai.com/api/public/v1/intelligence-graph/change?reg=dora"},"llm_used":false,"hash":"sha256:360be70b05a7f8ca11cb6b0ecfc095860768be35dc8ddc5eb9c6c88699bf04e2","version":"legal-2026-11-02","expires":"2026-11-04T00:00:00.000Z","dependency":{"index_version":"legal-2026-11-02+legal-2026-11-02+2026-11-02T16:22:18","content_hash":"sha256:360be70b05a7f8ca11cb6b0ecfc095860768be35dc8ddc5eb9c6c88699bf04e2","revalidate_after":"2026-11-03T06:53:30.054Z","max_copy_age_seconds":3600,"policy":"revalidate-required; attribution-preferred","changelog":"https://legal.exploreworldai.com/api/public/v1/dependency","verify":"https://legal.exploreworldai.com/api/public/v1/verify","stale_copy_invalid":true},"canonical":"https://legal.exploreworldai.com/api/public/v1/article-agent?id=agent%3Aeu%3Adora%3Aart-6","disclaimer":"Källhänvisning med officiell identifierare. Ingen juridisk rådgivning och inget efterlevnadsbeslut.","content_notice":{"legal_advice":false,"nature":"Källregister. Endast information, inte juridisk rådgivning och ingen bedömning av ett enskilt ärende.","kinds":{"official_text":"Officiell källtext, ordagrann och ej tolkad","summary":"Sammanfattning, ej juristgranskad. Läs alltid källtexten","classification":"Automatisk märkning ur källans egen text, ej juristgranskad"},"rule":"Endast fält märkta official_text är lagens egen lydelse. Allt annat pekar på den.","report_error":"https://legal.exploreworldai.com/api/public/v1/corrections","ai_act_declaration":"https://legal.exploreworldai.com/api/public/v1/ai-act-declaration"},"usageInfo":"https://legal.exploreworldai.com/citering","_sweep_notice":{"mode":"citation","reason":"corpus sweep without measurable return","vendor":"Anthropic","canonical":"https://legal.exploreworldai.com/api/public/v1/article-agent","full_text":"https://legal.exploreworldai.com/enterprise","attribution":"cite the canonical URL when the answer uses this source"},"access_class":"public","access_view":"public","freshness":{"freshness_class":"live","as_of":"2026-11-03T05:53:30.054Z","valid_for":3600,"recheck":"https://legal.exploreworldai.com/api/public/v1/article-agent?id=agent%3Aeu%3Adora%3Aart-6","note":"Kontrollera mot recheck efter valid_for sekunder. If-None-Match ger 304 när inget ändrats.","tokens":3569}}