DORA som noder
Varje objekt har egen adress, version och hash. Grafversion 2026-10-10.1. Source: NovaCopilot.
Krav (24)
- ICT incident management process
- Record all ICT incidents and significant cyber threats
- Inform senior management and the management body of major incidents
- Classify incidents on six criteria (summary)
- Report major ICT incidents to the competent authority
- Inform clients without undue delay
- Initial notification, intermediate report and final report (summary)
- Full responsibility remains with the financial entity
- Strategy on ICT third-party risk reviewed by the management body (summary)
- Register of information on all ICT contracts
- Yearly report to the competent authority
- Pre-contract assessment and due diligence (summary)
- ICT concentration risk: substitutability and multiple contracts (summary)
- Rights and obligations in one written contract
- Minimum contract terms (summary)
- Additional terms for critical or important functions (summary)
- Internal governance and control framework for ICT risk
- Management body defines, approves and oversees the ICT risk framework
- Ultimate responsibility for ICT risk
- Budget for digital operational resilience
- Management body ICT knowledge and training
- Sound, comprehensive and well-documented ICT risk framework
- Independent ICT risk control function
- Annual review of the ICT risk framework
Kontroll (12)
- Client notification of major incidents
- Resilience budget and management body ICT training
- Mandatory ICT contract clauses and exit plan
- Register of information on ICT contracts and yearly report
- Independent ICT risk control function
- Documented ICT risk framework with annual review
- ICT third-party risk strategy and board review
- Major incident reporting to senior management and the board
- Incident register and six-criteria classification
- Three-step major incident reporting to the authority
- Management body ICT risk oversight and approval
- Pre-contract due diligence and concentration risk assessment
Evidens (12)
- annual framework review report
- authority notification records
- board ict approval minutes
- client notification records
- control function mandate
- incident classification log
- management incident report
- register of information
- signed contract clause checklist
- third party strategy approval
- training and budget records
- vendor assessment file