ICT risk management (DORA)

Under Art. 8(7) of DORA, FEs must perform ICT risk assessments on legacy systems at least annually and in any case before and after connecting technologies, applications, or systems. In this regard, “connection” relates to e.g. integrations, interfacing of systems/tools, or changes to legacy systems that can add new interdependencies and/or vulnerabilities.Moreover, the RTS on RMF detail this interpretation by describing the procedures for ICT risk management, such as the need of change management policy and procedures (Art. 17) and the identification of interdependencies between systems and providers (Art. 8). These provisions highlight the importance of assessing connections as part of a broader strategy to manage ICT risks.