DORA ICT Risk Management Framework: What to Document (RTS 2024/1774)
DORA requires a "sound, comprehensive and well-documented" ICT risk management framework. Delegated Regulation (EU) 2024/1774 lists the policies and procedures that make it up. This is the document map, article by article, for both the full and the simplified framework.
Articles 5 to 15 of DORA (Regulation (EU) 2022/2554) set the principles of ICT risk management; Article 15 asked the European Supervisory Authorities for technical standards on the tools, methods, processes and policies. The result is Commission Delegated Regulation (EU) 2024/1774. Title II applies to most financial entities; Title III sets the simplified framework for the entities listed in Article 16(1) of DORA.
Proportionality first
Article 1 requires you to take into account your size and overall risk profile, and the nature, scale and complexity of your services, activities and operations, when developing and implementing these policies and procedures. The list below says what must exist; how detailed each document is depends on you.
General requirements for ICT security policies (Article 2)
Your ICT security policies must be embedded in the framework, aligned with the information security objectives in your digital operational resilience strategy, show the date of formal approval by the management body, and contain indicators to monitor implementation and record exceptions.
The document map (Title II)
| Document | RTS article |
|---|---|
| ICT risk management policy and procedures: approved risk tolerance, risk assessment methodology with impact and likelihood indicators, risk treatment, residual risk acceptance | 3 |
| ICT asset management policy and procedure, including an inventory of ICT assets | 4, 5 |
| Encryption and cryptographic controls policy, based on data classification and risk assessment | 6 |
| Cryptographic key management | 7 |
| ICT operations policies and procedures | 8 |
| Capacity and performance management | 9 |
| Vulnerability and patch management, including automated scanning proportionate to asset classification and checks on ICT providers | 10 |
| Data and system security | 11 |
| Logging: which events, retention, protection of log data | 12 |
| Network security management | 13 |
| Securing information in transit | 14 |
| ICT project management | 15 |
| ICT systems acquisition, development and maintenance | 16 |
| ICT change management | 17 |
| Physical and environmental security | 18 |
| Human resources policy (ICT security aspects) | 19 |
| Identity management and access control | 20, 21 |
| ICT-related incident management policy, and criteria for detecting anomalous activities and incidents | 22, 23 |
| ICT business continuity policy, its testing, and ICT response and recovery plans | 24, 25, 26 |
| Report on the review of the ICT risk management framework, in a searchable electronic format | 27 |
Check your coverage: the free DORA Compliance Checker scores ICT risk management alongside the other four DORA pillars.
The simplified framework (Title III)
Small and non-interconnected investment firms, exempted payment and e-money institutions, exempted credit institutions and small occupational pension funds do not apply DORA Articles 5 to 15; they follow Article 16 of DORA instead. Title III of the Delegated Regulation sets what their simplified framework contains:
| Area | RTS article |
|---|---|
| Governance and organisation | 28 |
| Information security policy and measures | 29 |
| Classification of information assets and ICT assets | 30 |
| ICT risk management | 31 |
| Physical and environmental security | 32 |
| Access control | 33 |
| ICT operations security | 34 |
| Data, system and network security | 35 |
| ICT security testing | 36 |
| ICT systems acquisition, development and maintenance | 37 |
| ICT project and change management | 38 |
| Business continuity plan and its testing | 39, 40 |
| Report on the review of the simplified framework | 41 |
How to build it without drowning
- Start with the risk management policy (Article 3). It sets the risk tolerance and methodology that every other document refers to.
- Build the asset inventory early (Articles 4 and 5). Encryption, patching and access control all depend on knowing what you have and how critical it is.
- Group documents sensibly. The Delegated Regulation lists required content, not file names. One ICT security policy with sections can cover several articles, as long as each required element is there.
- Have the management body approve and date it (Article 2(2)(b)), and plan the annual review that feeds the Article 27 report.
- Keep evidence of operation: scan results, access reviews, change records and test reports show that the documents are applied.
A head start on the framework. The DORA Compliance Checklist pack includes an ICT risk management framework template, a gap-assessment workbook, an incident classification matrix and a third-party provider register.
Sources
- Commission Delegated Regulation (EU) 2024/1774: ICT risk management tools, methods, processes and policies, and the simplified framework, EUR-Lex
- Regulation (EU) 2022/2554 (DORA), Articles 5 to 16, EUR-Lex
Related tools
Further reading: DORA Compliance Checklist · DORA Major Incident Classification
ClevSec
Compliance & security tools for modern businesses
We build practical tools and templates that help startups and SMBs stay compliant with NIS2, GDPR, and DORA. Explore our free tools →
This article is for informational purposes only and does not constitute legal advice. Last updated: October 2026.