DORA ICT Risk Management: Building the Infrastructure That Satisfies Articles 5-16

DORA Articles 5-16 establish an ICT risk management framework that mirrors NIST CSF but with teeth — mandatory, supervised, and enforceable. For infrastructure teams, this means building systems that continuously identify, protect, detect, respond to, and recover from ICT risks.

Identify: ICT Asset Management Infrastructure

• Automated asset discovery — Continuous scanning of all networks, cloud accounts, and endpoints to maintain a real-time asset inventory
• Dependency mapping — Automated mapping of dependencies between ICT assets, business functions, and third-party services
• Classification automation — Auto-classify assets by criticality based on the business functions they support
• CMDB integration — Single source of truth for all ICT assets with change tracking

Protect: Security Controls Infrastructure

• Identity and access management — Zero-trust architecture, MFA everywhere, privileged access management, just-in-time access
• Network segmentation — Micro-segmentation, east-west traffic filtering, software-defined perimeters
• Encryption enforcement — At-rest and in-transit encryption with automated key rotation, HSM-backed key management
• Patch management — Automated patching with risk-based prioritization and change management integration

Detect: Monitoring and Detection Infrastructure

• SIEM/SOAR — Centralized security event management with automated response playbooks
• Anomaly detection — ML-based behavioral analysis for network, user, and application anomalies
• Threat intelligence integration — Real-time correlation with external threat feeds

Respond and Recover

• Incident response automation — Pre-built playbooks for common incident types, automated containment
• Disaster recovery infrastructure — Multi-site replication, automated failover, tested recovery procedures
• Backup infrastructure — Immutable backups, air-gapped copies, automated restoration testing

The Continuous Improvement Loop

DORA requires the ICT risk framework to be reviewed annually and after major incidents. Your infrastructure must support this: metrics collection, trend analysis, gap identification, and remediation tracking — all automated.