# What does DORA require from the management of a financial entity?

It puts final responsibility for managing ICT risk on the management body, which cannot hand that responsibility to an IT department or a supplier. Under DORA the management body defines, approves and oversees the ICT risk-management framework and is accountable for its implementation. In practice that means approving the digital operational resilience strategy and the policies behind it, setting and reviewing the budget, approving arrangements with ICT third-party providers and the policy for using them, being informed of major incidents and their consequences, and keeping its own knowledge and skills up to date through training. For directors, this is a governance duty that a supervisor can examine: minutes, approved documents and evidence that reports were read and acted on. Ask your compliance function how your organisation documents these decisions, and use the national supervisor’s guidance for the details. NetSenX plays no part in that governance, but its alerts and PDF compliance reports, from the Starter plan, can be one source of the information the management body receives.

General information, not legal advice. National laws can add to the EU texts quoted here, for example deadlines, forms or reporting channels: check your own country's rules.

FAQ: [EU law: GDPR, DORA, CRA and AI Act](https://netsenx.com/en/faq/eu-law) · https://netsenx.com/en/faq/what-does-dora-require-from-management

## Read next

- https://netsenx.com/en/blog/2026-10-26_ai-act-nis2-dora-cra
- https://netsenx.com/en/compliance
- https://netsenx.com/en/dpa

## Related questions

- [What is the Cyber Resilience Act, in plain terms?](https://netsenx.com/en/faq/what-is-the-cyber-resilience-act)
- [Does the Cyber Resilience Act apply to software companies?](https://netsenx.com/en/faq/does-the-cra-apply-to-software-companies)
- [Does the Cyber Resilience Act apply to software as a service?](https://netsenx.com/en/faq/does-the-cra-apply-to-saas)
- [What is an SBOM, and does the Cyber Resilience Act require one?](https://netsenx.com/en/faq/what-is-an-sbom-and-does-the-cra-require-one)
- [What is the EU AI Act, in plain terms?](https://netsenx.com/en/faq/what-is-the-eu-ai-act-in-plain-terms)