{"id":155759,"date":"2024-08-26T08:56:16","date_gmt":"2024-08-26T06:56:16","guid":{"rendered":"https:\/\/www.fma.gv.at\/?page_id=155759"},"modified":"2025-01-15T11:09:43","modified_gmt":"2025-01-15T10:09:43","slug":"dora-ict-risk-management","status":"publish","type":"page","link":"https:\/\/www.fma.gv.at\/en\/cross-sectoral-topics\/dora\/dora-ict-risk-management\/","title":{"rendered":"DORA – ICT Risk Management"},"content":{"rendered":"
<\/span>\"\"
\n

ICT Risk Management<\/p>\n<\/div><\/div>

<\/div>

This web page contains the rules in relation to governance and organisation of the Digital Operational Resilience Act (DORA), following by the requirements for the risk management framework for information and communication technology (ICT risk management framework) in relation to ICT systems, protocols and tools as well as to the ICT risk management functions.<\/p>

Governance and organisation<\/strong><\/h2>

DORA’s provisions start by emphasising the responsibility of the management body. A governance framework is required to be established that guarantees that ICT risks are managed effectively.<\/p>

For example, appropriate resources are to be made available, a digital operational resilience strategy adopted, the corresponding risk tolerance thresholds determined, information channels established for using ICT third-party service providers or for major ICT incidents, an ICT business continuity policy and ICT response and recovery plans approved, and training measures planned for all staff members.<\/p>

ICT risk management framework<\/h2>

Strategies, policies, procedures, ICT protocols and tools to protect all information assets and ICT assets are to be determined to guarantee a high level of digital operational resilience.<\/p>

Information about ICT risks and the ICT risk management framework are to be updated on an ongoing basis. An appropriate and independent ICT control function is to be established. In addition, the documentation about the at least annual review of the ICT risk management framework is to be submitted to the Financial Market Authority (FMA) upon request. <\/p>

Furthermore, standards are to be defined about the contents of a digital operational resilience strategy, for example regarding using the ICT risk management framework to support the business strategy or for defining information security objectives.  <\/p>

ICT systems, protocols and tools<\/h2>

Identification<\/h3>

Inventories of ICT assets and information assets, as well as ICT-based functions, roles and responsibilities and ICT third-party service providers will be kept and updated on a regular basis as well as where there are any significant changes. The identified ICT assets and information assets shall also be subject to a risk classification. <\/p>

Financial undertakings shall identify sources of risk on a continuous basis, and shall also take into account the risk in relation to other financial undertakings. A regular risk assessment shall also be conducted on legacy ICT systems.<\/p>

Protection and prevention<\/h3>

ICT systems should be continuously monitored. The objective is to ensure the resilience, continuity and availability of ICT systems. High standards should also be guaranteed regarding the availability, authenticity, integrity and confidentiality of data. <\/p>

Numerous measures are to be implemented to achieve this objective, such as physical or logical access restrictions, strong authentication mechanisms, segmenting of networks or rules about patches and updates.<\/p>

Detection<\/h3>

The next step is the detection of anomalous activities. They related to ICT networks, ICT-related incidents and vulnerabilities. <\/p>

Detection mechanisms permit multiple layers of control, define alert thresholds and criteria for initiating response processes.<\/p>

Response and recovery<\/h3>

Response and recovery measures are taken accordingly once anomalous activities are detected. For this purpose an ICT business continuity policy is to be defined for ensuring the continuity of critical or important functions as well as for defining rapid and appropriate reactions to ICT-related incidents.<\/p>

ICT business continuity plans and ICT response and recovery plans are implemented based on a business impact analysis. A crisis management function coordinates, among other things, the internal and external crisis communications in the event of the activation of these plans. <\/p>

The DORA Regulation (DORA) also determines requirements regarding backups and recovery procedures and methods. For example, as a rule adequate and appropriate redundant ICT capacities are to be established for ensuring business needs.<\/p>

Learning and evolving<\/h3>

Financial undertakings shall have adequate resources in place to gather and analyse information on vulnerabilities, cyber threats as well as technological developments. In particular, the causes of major ICT-related incidents must be identified to prevent similar incidents in the future. <\/p>

Training measures must in any case be completed by all staff members and the management as well as where applicable by ICT third-party service providers.<\/p>

Communications<\/h3>

As a minimum major ICT-related incidents or vulnerabilities are to be disclosed towards customers and other financial undertakings in a responsible manner as well as to the general public depending on the circumstances. <\/p>

Further and in some cases very specific rules are defined in the Regulatory Technical Standards to be developed in relation to the ICT risk management framework.<\/p>

Questions and Answers<\/h2>