DORA · pillar 2 of 5
Governance — the management body owns it
Final responsibility is named, and it is not the CISO's.
- 4 Ultimate responsibility has a name The management body shall define, approve, oversee and be responsible for the implementation of all arrangements…
- 5 A framework, reviewed on two triggers Entities must maintain a sound, comprehensive and well-documented ICT risk management framework, reviewed at least once…
- 6 The board has to keep up Members of the management body must actively keep up to date with sufficient knowledge and skills to understand and…
Start this pillar See the whole map
Read against Regulation (EU) 2022/2554 (DORA), Directive (EU) 2022/2555 (NIS2), Commission Delegated Regulation (EU) 2025/301 — RTS on major ICT-related incident reporting on . Regulations and frameworks change; the date is there so you can tell whether this has kept up.