229. Competent authorities should assess how the roles and responsibilities for all ICT-related …

Competent authorities should assess how the roles and responsibilities for all ICT-related functions and the established governance arrangements are embedded and integrated in the institution’s internal control and governance framework to manage ICT risk. For this purpose, competent authorities should consider whether the institution has effectively assigned the responsibility for managing and overseeing ICT risk to an independent control function that has direct access and can report directly to the management body in its supervisory function, and assess whether the institution demonstrates:

• a. clear communication, allocation and integration of roles and responsibilities in all ICT-related functions, including ICT supported business functions, and processes;
• b. sufficient and appropriate budget to fulfil digital operational resilience in terms of all types of resources, including relevant awareness programmes, training, and ICT skills for all staff (as per Article 5(2)(g) of DORA);
• c. adequate follow-up and response by the management body on critical ICT audit findings and findings reported under Article 13(5) of DORA.

1. Forbhreathnú

1.1 Tagairtí

• Airteagal 13 5

1.2 Ceanglais aitheanta

1.3 Caighdeáin ghaolmhara

2. Ceanglais aitheanta

3. Caighdeáin ghaolmhara

• EBA - Published by the European Banking Authority at https://www.eba.europa.eu/