A framework, reviewed on two triggers
Entities must maintain a sound, comprehensive and well-documented ICT risk management framework, reviewed at least once a year, and additionally upon the occurrence of major ICT-related incidents and following supervisory instructions or conclusions from testing.
Why it is like this
An annual cycle alone would mean a framework that learns about an incident eleven months later. The second trigger makes the incident itself the review.
Not to be confused with
A policy document. The framework includes strategies, policies, procedures, protocols and tools, and must be documented and reviewed as a whole — and audited by auditors with sufficient ICT knowledge, on a frequency matched to the entity's risk profile.
In practice
A major incident in March means the framework is reviewed in March, not at the December refresh.
Source: Regulation (EU) 2022/2554 (DORA) — Art. 6. Read on .
Odd one out Check yourself
Three of these trigger a review of the ICT risk management framework. Which one does not, by itself?
Show the answer
A change of cloud region by one supplier
A supplier change is handled through the third-party chapter and the register. The framework's review triggers are the annual cycle, major incidents, supervisory instruction and testing conclusions.