Chapter II — ICT risk management
Section I — Governance
ICT risk management framework
Summary
Requires financial entities to maintain a sound, comprehensive and well-documented ICT risk management framework. The framework must include strategies, policies, procedures and tools necessary to protect all ICT assets and infrastructure and to duly manage ICT risk in accordance with the entity's risk appetite.
Key Requirements
- 1
Comprehensive and well-documented framework covering all ICT risks
- 2
Framework must be reviewed at least annually
- 3
Include all ICT assets and dependencies in scope
- 4
Identify and classify all critical or important functions
- 5
Continuous improvement based on lessons learned and testing
Detailed Analysis
Article 6 outlines the core requirements for the ICT risk management framework that every financial entity must establish and maintain. This framework serves as the central organizing structure for all ICT-related risk management activities and must be comprehensive enough to address the full lifecycle of ICT risk.
The framework must encompass strategies, policies, procedures, ICT protocols, and tools necessary to adequately protect information and ICT assets. It must address the full spectrum of risks including cyber threats, technology failures, human error, and natural disasters. The framework must be documented, reviewed at least annually, and updated following major incidents, audit findings, or significant changes in the ICT environment.
A critical requirement is the identification and classification of all ICT-supported business functions, roles, and assets. Financial entities must maintain an up-to-date inventory of their information assets and ICT assets, mapping dependencies between them. Functions must be assessed for criticality, with enhanced protections applied to those classified as critical or important.
The framework must be proportionate but robust. Even entities subject to the simplified framework under Article 16 must establish adequate governance, risk identification, protection mechanisms, detection capabilities, and recovery procedures. The framework's maturity is expected to evolve continuously, incorporating lessons learned from incidents, testing results, and emerging threat intelligence.
Ready to automate compliance with Article 6?
Valendir maps every DORA requirement to actionable controls, evidence, and workflows.