Skip to main content
TAIARO
FREN
Back to home

Reading grid

DORA: ICT risk governance and third-party risk

The DORA regulation (Digital Operational Resilience Act) rests on five pillars. This page deliberately covers the two where I have verifiable field practice in Core Banking modernisation — not all five. The other three (incident management, resilience testing, information sharing) are not covered here.

1. ICT risk governance and management

  1. 1. Critical function mapping — precisely identify which business functions depend on which systems, down to the legacy component — an incomplete mapping is the first risk signal flagged in audit.
  2. 2. Formalised Board accountability — ICT risk must be explicitly owned by the governing body, not implicitly delegated to IT alone.
  3. 3. Documented and tested continuity plan — beyond the document: verify the plan has actually been exercised, not just written.

2. ICT third-party risk management

  1. 1. Critical vendor mapping — list the ICT providers whose failure would interrupt an essential service, including tier-2 subcontractors.
  2. 2. Contractual exit clauses — verify that each critical contract includes a workable exit clause (reversibility, data portability), not a boilerplate clause never tested.
  3. 3. Cloud provider exit plan — a concrete, costed and dated switchover or repatriation scenario — not a stated intention.

This grid supports a Tech Due Diligence or strategic architecture mandate; it does not replace a formal regulatory compliance audit.