DORA Governance Requirements: Management Accountability

Board members, executives, and senior leaders must now actively engage with ICT risk management, undergo training, and take personal responsibility for their organization's digital resilience.

Key Takeaways

Quick Answer: DORA requires the management body (board of directors, executive management, or equivalent) to take direct responsibility for ICT risk management. This includes approving the ICT risk framework, ensuring adequate resources, undergoing training to understand ICT risks, and actively overseeing implementation. Individual members can be held personally liable for failures, with potential penalties up to 1 million per individual.

Who Is the Management Body?

DORA's governance requirements apply to the "management body," defined in line with sectoral legislation:

In practice, this means the board of directors and senior executive team.

Core Governance Responsibilities

Framework Ownership

The management body must:

This cannot be fully delegated. While day-to-day management may be assigned to others, the management body retains ultimate accountability.

ICT Risk Management Framework

Specific management body obligations regarding the framework:

Resource Allocation

The management body must ensure adequate resources:

Business Continuity

Specific obligations for business continuity:

• Approve the ICT business continuity policy
• Ensure continuity plans are in place
• Review testing results
• Oversee crisis management arrangements

Training Requirements

Management Body Training

DORA explicitly requires management body members to:

"Actively keep up to date with sufficient knowledge and skills to understand and assess ICT risk and its impact on the operations of the financial entity."

This means regular training on:

Training Format

Training may include:

• Board-level briefings from ICT leadership
• External expert presentations
• Industry conferences and events
• Formal training programs
• Scenario exercises and simulations

Documentation

Maintain evidence of management body training:

• Training records
• Meeting minutes reflecting ICT discussions
• Attendance at relevant events
• Qualifications and certifications

Oversight and Reporting

ICT Risk Reporting to Management

The management body should receive regular reporting on:

Board Agenda Items

ICT risk should be a regular board agenda item:

• Review of ICT risk metrics and trends
• Significant incident reviews
• Third-party risk updates
• Testing and audit results
• Resource and budget discussions
• Regulatory developments

Decision Documentation

Document management body decisions on ICT matters:

• Policy approvals
• Resource allocations
• Risk acceptance decisions
• Third-party arrangements
• Framework changes

Organizational Structure

ICT Risk Management Function

For non-microenterprises, DORA requires an ICT risk management function that is:

• Independent from operational ICT functions
• Adequately staffed and resourced
• Capable of reporting directly to senior management

Reporting Lines

Clear reporting lines for ICT risk matters:

1Management Body
2       ↑
3   ICT Risk Reports
4       ↑
5ICT Risk Management Function
6       ↑
7   Information from
8       ↑
9ICT Operations, Security, Third-Party Management

Roles and Responsibilities

Define clear responsibilities for:

Personal Liability

Individual Accountability

DORA creates personal liability for management body members:

Potential Consequences

Individual penalties may include:

D&O Insurance

Directors should review their D&O insurance coverage regarding:

• DORA-related claims
• Regulatory investigation costs
• Defense expenses
• Limitations and exclusions

Practical Implementation

Board Education

Start with management body education:

1. Brief board on DORA requirements and implications
2. Explain personal accountability provisions
3. Define what active oversight means in practice
4. Establish ongoing training cadence

Governance Enhancements

Consider structural changes:

Documentation Practices

Maintain robust documentation:

• Board minutes reflecting ICT discussions
• Approval records for policies and frameworks
• Training records for management body
• Decision rationale for significant choices

Common Questions

Can we delegate ICT risk management entirely to the CTO?

No. While day-to-day management may be delegated, the management body retains ultimate accountability for the framework. Active oversight, approval, and resource allocation remain management body responsibilities.

How often should the board discuss ICT risk?

ICT risk should be a regular agenda item, at minimum quarterly. Significant incidents or changes warrant immediate board attention.

What training is required?

DORA requires management body members to maintain "sufficient knowledge and skills" to understand ICT risk. The specific training depends on individual background and entity complexity, but regular updates are essential.

Does this apply to non-executive directors?

Yes. All management body members share accountability for ICT risk management, including non-executive directors. They must be sufficiently informed to provide effective oversight.

How do we demonstrate compliance?

Maintain evidence of governance activities: meeting minutes, training records, approval documents, reporting materials, and decision documentation. Regulators may request this evidence during examinations.

How Bastion Helps

Bastion supports management bodies in meeting DORA governance requirements:

• Board briefings: Executive-level presentations on DORA obligations
• Training programs: Tailored training for management body members
• Governance design: Establishment of appropriate oversight structures
• Reporting frameworks: Design of ICT risk reporting to management
• Documentation: Support for governance documentation

Ready to strengthen your ICT risk governance? Talk to our team

Sources

• DORA Article 5 - Governance and organisation
• DORA Article 13 - Learning and evolving
• DORA Article 50-52 - Penalties and liability provisions