The report on the review of the ICT risk management framework under DORA Article 6(5) must be submitted in a searchable electronic format and contain: an introduction identifying the entity and group, its context, critical functions, strategy, major projects and ICT dependencies, major changes since the last report and an executive summary of the ICT risk profile, threat landscape, control effectiveness and security posture; the management body approval date; the reason for the review (with explicit references where supervisory instructions, test or audit conclusions triggered it, and a list of incidents with root cause analysis where incidents did); review period dates and the responsible function; changes and improvements since the previous review with their impact on the strategy, internal control framework and governance; findings with severity analysis; remediation measures with dates, progress, tools and owners, resource impact, how the competent authority is informed, and for unremediated gaps the criteria for accepting residual risk; planned developments; conclusions; past reviews and the status of earlier corrective measures; and the sources used, including internal audit (except microenterprises), compliance assessments, resilience and TLPT results and external sources.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.