YTYK You think you know

Card 3 of 15 Scope — finance, and the suppliers behind it ●●○ Working knowledge

Proportionate, not optional

DORA is applied proportionately to an entity's size, risk profile and the nature of its services, and certain smaller entities may use a simplified ICT risk management framework rather than the full one.

Why it is like this

A single standard written for a systemic bank would be unworkable for a twelve-person payment institution, and writing twenty regimes would be unenforceable. Proportionality is the compromise.

Not to be confused with

An exemption, or a lighter set of outcomes. The simplified framework still requires a documented framework, incident reporting, testing and third-party management — it reduces the depth expected, not the list of things you must have.

In practice

"We are small" is a statement about how much evidence is proportionate, not about whether the register of information has to exist.

Source: Regulation (EU) 2022/2554 (DORA) — Art. 4 and Art. 16. Read on .

Predict Check yourself

A 15-person payment institution concludes that proportionality means it needs no register of ICT contracts. Right or wrong?

  1. Wrong — proportionality scales the depth of what is expected; it does not remove an obligation.
  2. Right — the register applies only to entities above the simplified-framework threshold.
  3. Right, provided it has fewer than ten ICT contracts.
  4. Wrong, but only if one of its providers is designated critical.
Show the answer

Wrong — proportionality scales the depth of what is expected; it does not remove an obligation.

This is the most common misreading of Article 4. Proportionality is about how much, not whether.