Entities under DORA Article 16(1) must have an internal governance and control framework for effective and prudent ICT risk management. The management body must carry overall responsibility for the simplified framework supporting the business strategy within risk appetite; set roles for all ICT tasks; set information security objectives and ICT requirements; approve, oversee and periodically review the asset classification, main risks, BIA and policies, and the continuity plans and response and recovery measures; allocate and review at least yearly the resilience budget, including awareness, training and ICT skills for all staff; specify and implement the Title III policies and measures; set procedures, protocols and tools to protect all assets; keep staff knowledge of ICT risk current; and set reporting arrangements on information security and resilience. Verification of compliance may be outsourced while full responsibility stays with the entity; control and internal audit functions must be segregated and independent; the simplified framework must be internally audited by independent, competent auditors at a risk-based frequency; and critical audit findings must be verified and remedied promptly.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.