DORA Board Responsibilities: From Policy to Decisions

Understand whose responsibility DORA is describing

The starting point is the regulated legal entity. DORA’s scope and exclusions appear in Article 2, while Article 3(30) maps the term “management body” to applicable sectoral and national governance arrangements. A commercial job title alone does not settle that mapping. Record which body or bodies fulfil the relevant functions in your organisation.

In the general framework, Article 5(2) places the ICT risk framework with the management body, including ultimate responsibility for the entity’s ICT risk. That is compatible with specialists doing the work. The practical question is whether the board can show that it established expectations, received adequate information, challenged gaps and followed material decisions through.

This article focuses on that general framework. Entities within Article 16 follow a simplified regime instead of Articles 5–15; governance provisions for that regime are developed in Article 28 of Delegated Regulation 2024/1774. Confirm the applicable regime before turning this guide into an internal obligation register.

Group arrangements need the same clarity. A parent can provide security operations, purchasing or policy expertise. The subsidiary still needs a usable view of the services it depends on, the risks it carries and the decisions its own governing body must make. “The group handles it” is an incomplete explanation of accountability.

Treat approval as the beginning of oversight

Article 5 covers responsibilities including the resilience strategy and ICT risk tolerance, continuity and recovery arrangements, audit planning, resources, third-party policy and reporting channels. Read the precise allocation in Article 5(2)(c)–(i). The following is our practical way to organise the resulting work, rather than a substitute for the provision.

For every significant approval, keep a short decision record with three linked parts: what the board authorised, the assumptions on which it relied, and the evidence it expects to receive next. A strategy approval should lead to progress against priorities. A recovery-plan approval should lead to tested capability. A budget approval should lead to people, services or controls that actually address the identified exposure.

For example, approving a six-month remediation plan without asking who will perform the work creates a predictable problem. If the same two specialists are already committed to an essential migration, the plan may be impossible. Request the capacity assumptions before approval and record the trade-off. A realistic revised date with an explicit interim control is more useful than an aspirational date nobody can deliver.

Separate matters for decision from matters for information. Every paper asking for a decision should state the proposed action, credible alternatives, consequences of delay, unresolved uncertainty and the decision deadline. This makes it easier for directors to challenge the recommendation without becoming involved in each technical implementation detail.

Use a decision-rights matrix to remove ambiguity

Agree who prepares, challenges, decides and checks each material matter. Adapt this sample to your legal structure, reserved matters and committee terms of reference. “Board” below means the relevant management body in that structure; it does not mean every operational decision must wait for a full meeting.

The risk and compliance functions should be able to challenge the proposal without owning every operational control. Internal audit should retain the independence appropriate to its role. Do not make a committee both implement a fix and provide the only assurance that it worked.

Test the matrix with a real upcoming decision. If a supplier contract must be renewed next week, can everyone identify who can approve it, who can require conditions, and who accepts any residual exposure? Resolve conflicting answers before an incident or commercial deadline exposes them.

Translate risk tolerance into choices about services

A statement that the company has “low appetite for cyber risk” does not tell an executive how to choose between competing projects. Ask management to connect the statement to services, customer consequences, control expectations and escalation. Keep the distinction between a desired outcome and a demonstrated capability explicit.

Take a fictional investment firm considering a new client reporting platform. Management proposes a recovery objective based on the vendor’s marketing material. The board should ask whether the objective covers the complete reporting service: source data, authentication, reconciliation, staff access and customer distribution. If only the platform has been tested, record the untested dependencies and the decision they affect.

Useful challenge questions include:

• What harm develops if the service is unavailable or its data cannot be trusted?
• Which assumptions have been demonstrated, and which remain estimates?
• What can we continue safely while the main service is degraded?
• What event would require escalation or a different operating decision?
• Who can accept residual risk, for how long and with what conditions?

Set specific boundaries for exceptions. A time-limited exception can identify the affected service, rationale, interim safeguards, accountable owner, expiry and the circumstances requiring earlier reconsideration. Repeated extensions should prompt a discussion about whether the original plan remains credible. An exception log is a decision tool only when somebody acts on it.

Challenge whether the budget can deliver the promised outcome

Article 5(2)(g) addresses appropriate resources and periodic budget review. In practical terms, a budget is more informative when it connects expenditure to an outcome than when it simply labels spending “DORA” or “cybersecurity.” Ask management to explain the risk addressed, the delivery dependency and the evidence of improvement.

Compare these proposals: “Buy a new backup product” and “Demonstrate that the customer service can be restored with reconciled data using an isolated recovery environment.” The second makes room to ask about people, test time, integration and business validation. The product may be necessary, but purchasing it is not the same as achieving the outcome.

A useful investment paper should show:

1. The service and exposure that justify the work.
2. The outcome and how it will be verified.
3. One-off and ongoing costs, including staff time and supplier support.
4. Dependencies on other projects and scarce skills.
5. The residual exposure if the proposal is delayed or reduced.
6. The person who will confirm that the benefit has been delivered.

Include learning and decision exercises in resource planning. A plan can fail because staff do not know how to invoke it, even when the underlying technology works. Equally, training cannot compensate for a missing technical control. Keep those needs connected while measuring them separately.

Keep ownership when a supplier delivers the service

Outsourcing changes the delivery model; it does not remove the entity’s responsibilities. For entities subject to these policy requirements, Article 3 of Delegated Regulation 2024/1773 requires clear governance for relevant arrangements and at least annual management-body review of the policy for ICT services supporting critical or important functions. Check the exemptions in DORA Article 28(2), including microenterprises. This specific policy-review frequency should not be confused with a universal frequency for all board training.

For a material dependency, ask for a short service-focused explanation. What would customers lose if the supplier failed? Which other services rely on the same infrastructure or subcontractor? How will your organisation obtain information, maintain control and recover its data? What does an exit require in practice?

Consider a fictional renewal proposal with a substantial discount for a longer commitment. Management has a contractual right to export data but has never imported that export into another workable environment. The board does not need to design the migration. It should ask whether an exit claim is credible and whether renewal should depend on validating the data, estimating transition capacity or reducing another concentration.

Distinguish supplier documents from your own conclusions. A certification or assurance report can support due diligence, but check its scope, reporting period, exclusions and relevance to the service. Record who assessed the document and what remains unresolved.

The ECB’s 2026–28 supervisory priorities identify operational resilience and ICT capabilities as banking priorities and emphasise that critical-provider oversight complements banks’ own third-party risk management. These are banking supervisory priorities, not a claim that every financial entity has identical supervisory treatment.

Set crisis authority before the crisis arrives

Decide in advance how the board receives material information and what management can do immediately. An incident should not expose a disagreement about who can restrict a service, authorise emergency spending or issue a customer update. The operational team also needs clear routes for regulatory reporting under the applicable procedures.

Request concise updates with four elements: what is known, what remains uncertain, what action is underway, and what decision is required. Resist asking for a confident recovery time when the evidence cannot support one. Ask instead for the next verification milestone and when management will return with better information.

A recovery decision should address service integrity as well as availability. A reachable application may still contain missing, duplicated or inconsistent records. Ask who validates the business result, which reconciliations remain outstanding and what restrictions protect customers during partial recovery.

Test that governance through an exercise. Simulate the loss of the normal meeting channel, an unavailable executive and contradictory supplier updates. Observe whether authorised deputies can act and whether a decision record is maintained. This is a suggested exercise design; it does not replace the technical tests and other arrangements required under the applicable framework.

Afterwards, assign each material finding to one accountable owner and specify the evidence needed for closure. “Procedure updated” may close a documentation issue. It does not close an inability to restore service unless the relevant capability has also been demonstrated.

Run a meeting that produces decisions and a usable record

A compact agenda can be more useful than a long technical presentation. The sample below is a suggested recurring governance session; set its frequency according to your risks, applicable obligations and committee structure.

1. Review changes since the last meeting: service exposure, material incidents and dependencies.
2. Examine the most important gap between expected and demonstrated capability.
3. Decide on exceptions, resources or priorities that exceed delegated authority.
4. Challenge overdue actions and recurring extensions.
5. Confirm the next evidence to be presented and any learning required.

Minutes should explain material challenge without becoming a verbatim transcript. Record the information considered, the uncertainty acknowledged, the alternatives discussed, the decision and its conditions. Include an owner and return date. Avoid a generic sentence that the board “noted the cyber update” when a consequential risk was actually accepted.

Illustrative decision record: The board reviewed the recovery-test results for the customer reporting service. The application was restored, but business reconciliation was not completed within the planned window. Management will retain the interim manual check, validate its capacity and return with an end-to-end retest. The operations executive owns the action; the next review date is recorded in the action register.

This example is deliberately factual. It does not label the organisation compliant or claim the issue has disappeared. It makes the unresolved question and the next step visible. For choosing the information that supports such a meeting, use our DORA board reporting dashboard guide.

Improve the governance loop over the next 90 days

Use this improvement plan alongside current obligations; it is not permission to postpone an existing duty. Start with whichever gap creates the most immediate decision risk.

Measure the quality of closure. Select three completed actions and ask whether their supporting evidence addresses the original finding. If an action merely produced a document while the risk persists, reopen the discussion. Select one accepted exception and verify that its expiry, conditions and owner remain meaningful.

Finally, make sure directors understand the material they are expected to challenge. Our guide to DORA board training requirements explains how to structure role-based learning. Cybersecurity Training for Executives & Boards offers an introductory foundation of approximately 25 minutes across six lessons. Add your own governance arrangements and decision exercises; completing the course is not accreditation or a compliance determination.