Chapter II - ICT Risk Management

Chapter II of the Digital Operational Resilience Act (EU 2022/2554) establishes mandatory ICT risk-management requirements for financial entities, detailing governance structures, risk assessment processes, and security controls. It also obliges firms to conduct regular testing, maintain detailed documentation, and report significant ICT-related incidents to competent authorities.