ICT Risk Management Framework (Čl. 5-16)
DORA vyžaduje komplexní ICT risk management framework schválený vedením organizace.
Požadavky na governance
| Požadavek | Popis | Článek |
|---|
| Board odpovědnost | Vedení nese konečnou odpovědnost za ICT risk management | Čl. 5 |
| ICT strategie | Dokumentovaná Digital Operational Resilience Strategy | Čl. 6 |
| Risk tolerance | Definovaná a schválená boardem | Čl. 6 |
| Roční review | Minimálně každoroční přezkoumání | Čl. 6 |
Komponenty frameworku
%3btext-align:center%3b%7d%23mermaid-0 .edgeLabel p%7bbackground-color:rgba(232%2c232%2c232%2c 0.8)%3b%7d%23mermaid-0 .edgeLabel rect%7bopacity:0.5%3bbackground-color:rgba(232%2c232%2c232%2c 0.8)%3bfill:rgba(232%2c232%2c232%2c 0.8)%3b%7d%23mermaid-0 .labelBkg%7bbackground-color:rgba(232%2c 232%2c 232%2c 0.5)%3b%7d%23mermaid-0 .cluster rect%7bfill:%23ffffde%3bstroke:%23aaaa33%3bstroke-width:1px%3b%7d%23mermaid-0 .cluster text%7bfill:%23333%3b%7d%23mermaid-0 .cluster span%7bcolor:%23333%3b%7d%23mermaid-0 div.mermaidTooltip%7bposition:absolute%3btext-align:center%3bmax-width:200px%3bpadding:2px%3bfont-family:arial%2csans-serif%3bfont-size:12px%3bbackground:hsl(80%2c 100%25%2c 96.2745098039%25)%3bborder:1px solid %23aaaa33%3bborder-radius:2px%3bpointer-events:none%3bz-index:100%3b%7d%23mermaid-0 .flowchartTitleText%7btext-anchor:middle%3bfont-size:18px%3bfill:%23333%3b%7d%23mermaid-0 rect.text%7bfill:none%3bstroke-width:0%3b%7d%23mermaid-0 .icon-shape%2c%23mermaid-0 .image-shape%7bbackground-color:rgba(232%2c232%2c232%2c 0.8)%3btext-align:center%3b%7d%23mermaid-0 .icon-shape p%2c%23mermaid-0 .image-shape p%7bbackground-color:rgba(232%2c232%2c232%2c 0.8)%3bpadding:2px%3b%7d%23mermaid-0 .icon-shape .label rect%2c%23mermaid-0 .image-shape .label rect%7bopacity:0.5%3bbackground-color:rgba(232%2c232%2c232%2c 0.8)%3bfill:rgba(232%2c232%2c232%2c 0.8)%3b%7d%23mermaid-0 .label-icon%7bdisplay:inline-block%3bheight:1em%3boverflow:visible%3bvertical-align:-0.125em%3b%7d%23mermaid-0 .node .label-icon path%7bfill:currentColor%3bstroke:revert%3bstroke-width:revert%3b%7d%23mermaid-0 :root%7b--mermaid-font-family:arial%2csans-serif%3b%7d%3c/style%3e%3cg%3e%3cmarker id='mermaid-0_flowchart-v2-pointEnd' class='marker flowchart-v2' viewBox='0 0 10 10' refX='5' refY='5' markerUnits='userSpaceOnUse' markerWidth='8' markerHeight='8' orient='auto'%3e%3cpath d='M 0 0 L 10 5 L 0 10 z' class='arrowMarkerPath' style='stroke-width: 1%3b stroke-dasharray: 1%2c 0%3b'/%3e%3c/marker%3e%3cmarker id='mermaid-0_flowchart-v2-pointStart' class='marker flowchart-v2' viewBox='0 0 10 10' refX='4.5' refY='5' markerUnits='userSpaceOnUse' markerWidth='8' markerHeight='8' orient='auto'%3e%3cpath d='M 0 5 L 10 10 L 10 0 z' class='arrowMarkerPath' style='stroke-width: 1%3b stroke-dasharray: 1%2c 0%3b'/%3e%3c/marker%3e%3cmarker id='mermaid-0_flowchart-v2-circleEnd' class='marker flowchart-v2' viewBox='0 0 10 10' refX='11' refY='5' markerUnits='userSpaceOnUse' markerWidth='11' markerHeight='11' orient='auto'%3e%3ccircle cx='5' cy='5' r='5' class='arrowMarkerPath' style='stroke-width: 1%3b stroke-dasharray: 1%2c 0%3b'/%3e%3c/marker%3e%3cmarker id='mermaid-0_flowchart-v2-circleStart' class='marker flowchart-v2' viewBox='0 0 10 10' refX='-1' refY='5' markerUnits='userSpaceOnUse' markerWidth='11' markerHeight='11' orient='auto'%3e%3ccircle cx='5' cy='5' r='5' class='arrowMarkerPath' style='stroke-width: 1%3b stroke-dasharray: 1%2c 0%3b'/%3e%3c/marker%3e%3cmarker id='mermaid-0_flowchart-v2-crossEnd' class='marker cross flowchart-v2' viewBox='0 0 11 11' refX='12' refY='5.2' markerUnits='userSpaceOnUse' markerWidth='11' markerHeight='11' orient='auto'%3e%3cpath d='M 1%2c1 l 9%2c9 M 10%2c1 l -9%2c9' class='arrowMarkerPath' style='stroke-width: 2%3b stroke-dasharray: 1%2c 0%3b'/%3e%3c/marker%3e%3cmarker id='mermaid-0_flowchart-v2-crossStart' class='marker cross flowchart-v2' viewBox='0 0 11 11' refX='-1' refY='5.2' markerUnits='userSpaceOnUse' markerWidth='11' markerHeight='11' orient='auto'%3e%3cpath d='M 1%2c1 l 9%2c9 M 10%2c1 l -9%2c9' class='arrowMarkerPath' style='stroke-width: 2%3b stroke-dasharray: 1%2c 0%3b'/%3e%3c/marker%3e%3cg class='root'%3e%3cg class='clusters'/%3e%3cg class='edgePaths'%3e%3cpath d='M254.492%2c132.528L232.413%2c140.94C210.333%2c149.352%2c166.174%2c166.176%2c144.095%2c180.088C122.016%2c194%2c122.016%2c205%2c122.016%2c210.5L122.016%2c216' id='L_GOV_ID_0' class='edge-thickness-normal edge-pattern-solid edge-thickness-normal edge-pattern-solid flowchart-link' style='%3b' data-edge='true' data-et='edge' data-id='L_GOV_ID_0' data-points='W3sieCI6MjU0LjQ5MjE4NzUsInkiOjEzMi41MjgyMzE2ODczNTMwNH0seyJ4IjoxMjIuMDE1NjI1LCJ5IjoxODN9LHsieCI6MTIyLjAxNTYyNSwieSI6MjIwfV0=' marker-end='url(%23mermaid-0_flowchart-v2-pointEnd)'/%3e%3cpath d='M384.492%2c158L384.492%2c162.167C384.492%2c166.333%2c384.492%2c174.667%2c384.492%2c184.333C384.492%2c194%2c384.492%2c205%2c384.492%2c210.5L384.492%2c216' id='L_GOV_OC_0' class='edge-thickness-normal edge-pattern-solid edge-thickness-normal edge-pattern-solid flowchart-link' style='%3b' data-edge='true' data-et='edge' data-id='L_GOV_OC_0' data-points='W3sieCI6Mzg0LjQ5MjE4NzUsInkiOjE1OH0seyJ4IjozODQuNDkyMTg3NSwieSI6MTgzfSx7IngiOjM4NC40OTIxODc1LCJ5IjoyMjB9XQ==' marker-end='url(%23mermaid-0_flowchart-v2-pointEnd)'/%3e%3cpath d='M514.492%2c135.085L534.424%2c143.071C554.357%2c151.056%2c594.221%2c167.028%2c614.154%2c178.514C634.086%2c190%2c634.086%2c197%2c634.086%2c200.5L634.086%2c204' id='L_GOV_DET_0' class='edge-thickness-normal edge-pattern-solid edge-thickness-normal edge-pattern-solid flowchart-link' style='%3b' data-edge='true' data-et='edge' data-id='L_GOV_DET_0' data-points='W3sieCI6NTE0LjQ5MjE4NzUsInkiOjEzNS4wODQ2Mzc1MzU5OTZ9LHsieCI6NjM0LjA4NTkzNzUsInkiOjE4M30seyJ4Ijo2MzQuMDg1OTM3NSwieSI6MjA4fV0=' marker-end='url(%23mermaid-0_flowchart-v2-pointEnd)'/%3e%3cpath d='M122.016%2c322L122.016%2c328.167C122.016%2c334.333%2c122.016%2c346.667%2c143.482%2c361.993C164.948%2c377.32%2c207.881%2c395.639%2c229.347%2c404.799L250.813%2c413.959' id='L_ID_RR_0' class='edge-thickness-normal edge-pattern-solid edge-thickness-normal edge-pattern-solid flowchart-link' style='%3b' data-edge='true' data-et='edge' data-id='L_ID_RR_0' data-points='W3sieCI6MTIyLjAxNTYyNSwieSI6MzIyfSx7IngiOjEyMi4wMTU2MjUsInkiOjM1OX0seyJ4IjoyNTQuNDkyMTg3NSwieSI6NDE1LjUyODM4MDUxMDE2NDZ9XQ==' marker-end='url(%23mermaid-0_flowchart-v2-pointEnd)'/%3e%3cpath d='M384.492%2c322L384.492%2c328.167C384.492%2c334.333%2c384.492%2c346.667%2c384.492%2c356.333C384.492%2c366%2c384.492%2c373%2c384.492%2c376.5L384.492%2c380' id='L_OC_RR_0' class='edge-thickness-normal edge-pattern-solid edge-thickness-normal edge-pattern-solid flowchart-link' style='%3b' data-edge='true' data-et='edge' data-id='L_OC_RR_0' data-points='W3sieCI6Mzg0LjQ5MjE4NzUsInkiOjMyMn0seyJ4IjozODQuNDkyMTg3NSwieSI6MzU5fSx7IngiOjM4NC40OTIxODc1LCJ5IjozODR9XQ==' marker-end='url(%23mermaid-0_flowchart-v2-pointEnd)'/%3e%3cpath d='M634.086%2c334L634.086%2c338.167C634.086%2c342.333%2c634.086%2c350.667%2c614.762%2c363.505C595.438%2c376.343%2c556.79%2c393.685%2c537.466%2c402.356L518.142%2c411.028' id='L_DET_RR_0' class='edge-thickness-normal edge-pattern-solid edge-thickness-normal edge-pattern-solid flowchart-link' style='%3b' data-edge='true' data-et='edge' data-id='L_DET_RR_0' data-points='W3sieCI6NjM0LjA4NTkzNzUsInkiOjMzNH0seyJ4Ijo2MzQuMDg1OTM3NSwieSI6MzU5fSx7IngiOjUxNC40OTIxODc1LCJ5Ijo0MTIuNjY1MjA1OTU5Njg0NX1d' marker-end='url(%23mermaid-0_flowchart-v2-pointEnd)'/%3e%3c/g%3e%3cg class='edgeLabels'%3e%3cg class='edgeLabel'%3e%3cg class='label' data-id='L_GOV_ID_0' transform='translate(0%2c 0)'%3e%3cforeignObject width='0' height='0'%3e%3cdiv xmlns='http://www.w3.org/1999/xhtml' class='labelBkg' style='display: table-cell%3b white-space: nowrap%3b line-height: 1.5%3b max-width: 200px%3b text-align: center%3b'%3e%3cspan class='edgeLabel'%3e%3c/span%3e%3c/div%3e%3c/foreignObject%3e%3c/g%3e%3c/g%3e%3cg class='edgeLabel'%3e%3cg class='label' data-id='L_GOV_OC_0' transform='translate(0%2c 0)'%3e%3cforeignObject width='0' height='0'%3e%3cdiv xmlns='http://www.w3.org/1999/xhtml' class='labelBkg' style='display: table-cell%3b white-space: nowrap%3b line-height: 1.5%3b max-width: 200px%3b text-align: center%3b'%3e%3cspan class='edgeLabel'%3e%3c/span%3e%3c/div%3e%3c/foreignObject%3e%3c/g%3e%3c/g%3e%3cg class='edgeLabel'%3e%3cg class='label' data-id='L_GOV_DET_0' transform='translate(0%2c 0)'%3e%3cforeignObject width='0' height='0'%3e%3cdiv xmlns='http://www.w3.org/1999/xhtml' class='labelBkg' style='display: table-cell%3b white-space: nowrap%3b line-height: 1.5%3b max-width: 200px%3b text-align: center%3b'%3e%3cspan class='edgeLabel'%3e%3c/span%3e%3c/div%3e%3c/foreignObject%3e%3c/g%3e%3c/g%3e%3cg class='edgeLabel'%3e%3cg class='label' data-id='L_ID_RR_0' transform='translate(0%2c 0)'%3e%3cforeignObject width='0' height='0'%3e%3cdiv xmlns='http://www.w3.org/1999/xhtml' class='labelBkg' style='display: table-cell%3b white-space: nowrap%3b line-height: 1.5%3b max-width: 200px%3b text-align: center%3b'%3e%3cspan class='edgeLabel'%3e%3c/span%3e%3c/div%3e%3c/foreignObject%3e%3c/g%3e%3c/g%3e%3cg class='edgeLabel'%3e%3cg class='label' data-id='L_OC_RR_0' transform='translate(0%2c 0)'%3e%3cforeignObject width='0' height='0'%3e%3cdiv xmlns='http://www.w3.org/1999/xhtml' class='labelBkg' style='display: table-cell%3b white-space: nowrap%3b line-height: 1.5%3b max-width: 200px%3b text-align: center%3b'%3e%3cspan class='edgeLabel'%3e%3c/span%3e%3c/div%3e%3c/foreignObject%3e%3c/g%3e%3c/g%3e%3cg class='edgeLabel'%3e%3cg class='label' data-id='L_DET_RR_0' transform='translate(0%2c 0)'%3e%3cforeignObject width='0' height='0'%3e%3cdiv xmlns='http://www.w3.org/1999/xhtml' class='labelBkg' style='display: table-cell%3b white-space: nowrap%3b line-height: 1.5%3b max-width: 200px%3b text-align: center%3b'%3e%3cspan class='edgeLabel'%3e%3c/span%3e%3c/div%3e%3c/foreignObject%3e%3c/g%3e%3c/g%3e%3c/g%3e%3cg class='nodes'%3e%3cg class='node default' id='flowchart-GOV-0' transform='translate(384.4921875%2c 83)'%3e%3crect class='basic label-container' style='' x='-130' y='-75' width='260' height='150'/%3e%3cg class='label' style='' transform='translate(-100%2c -60)'%3e%3crect/%3e%3cforeignObject width='200' height='120'%3e%3cdiv xmlns='http://www.w3.org/1999/xhtml' style='display: table%3b white-space: break-spaces%3b line-height: 1.5%3b max-width: 200px%3b text-align: center%3b width: 200px%3b'%3e%3cspan class='nodeLabel'%3e%3cp%3eGOVERNANCE %e2%80%94 %c4%8cl. 5%3cbr /%3eBoard oversight%3cbr /%3eICT risk management function%3cbr /%3eSegregation of duties%3c/p%3e%3c/span%3e%3c/div%3e%3c/foreignObject%3e%3c/g%3e%3c/g%3e%3cg class='node default' id='flowchart-ID-2' transform='translate(122.015625%2c 271)'%3e%3crect class='basic label-container' style='' x='-114.015625' y='-51' width='228.03125' height='102'/%3e%3cg class='label' style='' transform='translate(-84.015625%2c -36)'%3e%3crect/%3e%3cforeignObject width='168.03125' height='72'%3e%3cdiv xmlns='http://www.w3.org/1999/xhtml' style='display: table-cell%3b white-space: nowrap%3b line-height: 1.5%3b max-width: 200px%3b text-align: center%3b'%3e%3cspan class='nodeLabel'%3e%3cp%3eIDENTIFIKACE %e2%80%94 %c4%8cl. 8%3cbr /%3eAsset inventory%3cbr /%3eRisk assessment%3c/p%3e%3c/span%3e%3c/div%3e%3c/foreignObject%3e%3c/g%3e%3c/g%3e%3cg class='node default' id='flowchart-OC-4' transform='translate(384.4921875%2c 271)'%3e%3crect class='basic label-container' style='' x='-98.4609375' y='-51' width='196.921875' height='102'/%3e%3cg class='label' style='' transform='translate(-68.4609375%2c -36)'%3e%3crect/%3e%3cforeignObject width='136.921875' height='72'%3e%3cdiv xmlns='http://www.w3.org/1999/xhtml' style='display: table-cell%3b white-space: nowrap%3b line-height: 1.5%3b max-width: 200px%3b text-align: center%3b'%3e%3cspan class='nodeLabel'%3e%3cp%3eOCHRANA %e2%80%94 %c4%8cl. 9%3cbr /%3eSecurity policies%3cbr /%3eAccess control%3c/p%3e%3c/span%3e%3c/div%3e%3c/foreignObject%3e%3c/g%3e%3c/g%3e%3cg class='node default' id='flowchart-DET-6' transform='translate(634.0859375%2c 271)'%3e%3crect class='basic label-container' style='' x='-101.1328125' y='-63' width='202.265625' height='126'/%3e%3cg class='label' style='' transform='translate(-71.1328125%2c -48)'%3e%3crect/%3e%3cforeignObject width='142.265625' height='96'%3e%3cdiv xmlns='http://www.w3.org/1999/xhtml' style='display: table-cell%3b white-space: nowrap%3b line-height: 1.5%3b max-width: 200px%3b text-align: center%3b'%3e%3cspan class='nodeLabel'%3e%3cp%3eDETEKCE %e2%80%94 %c4%8cl. 10%3cbr /%3eMonitoring%3cbr /%3eAlerting%3cbr /%3eAnomaly detection%3c/p%3e%3c/span%3e%3c/div%3e%3c/foreignObject%3e%3c/g%3e%3c/g%3e%3cg class='node default' id='flowchart-RR-10' transform='translate(384.4921875%2c 471)'%3e%3crect class='basic label-container' style='' x='-130' y='-87' width='260' height='174'/%3e%3cg class='label' style='' transform='translate(-100%2c -72)'%3e%3crect/%3e%3cforeignObject width='200' height='144'%3e%3cdiv xmlns='http://www.w3.org/1999/xhtml' style='display: table%3b white-space: break-spaces%3b line-height: 1.5%3b max-width: 200px%3b text-align: center%3b width: 200px%3b'%3e%3cspan class='nodeLabel'%3e%3cp%3eRESPONSE %26amp%3b RECOVERY %e2%80%94 %c4%8cl. 11-12%3cbr /%3eIncident response plans%3cbr /%3eBusiness continuity%3cbr /%3eDisaster recovery%3cbr /%3eCommunication plans%3c/p%3e%3c/span%3e%3c/div%3e%3c/foreignObject%3e%3c/g%3e%3c/g%3e%3c/g%3e%3c/g%3e%3c/g%3e%3c/svg%3e)
ICT Asset Management (Čl. 8)
Požadavky na inventář
Kategorie aktiv
| Kategorie | Příklady |
|---|
| Hardware | Servery, síťová zařízení, endpoints |
| Software | Aplikace, OS, middleware |
| Data | Databáze, úložiště, zálohy |
| Služby | Cloud services, SaaS, outsourcing |
Bezpečnostní opatření (Čl. 9)
Technická opatření
- Šifrování dat v klidu a při přenosu
- Network segmentation
- Multi-factor authentication
- Patch management
- Vulnerability management
Organizační opatření
- Security awareness training
- Incident response procedures
- Change management
- Access control policies
Business Continuity (Čl. 11-12)
Požadavky
| Oblast | Požadavek |
|---|
| BCP | Dokumentovaný Business Continuity Plan |
| DRP | Disaster Recovery Plan pro kritické systémy |
| RTO/RPO | Definované a testované |
| Testování | Minimálně roční testy BCP/DRP |
ICT Business Impact Analysis
Pro každý kritický proces:
- Identifikace závislých ICT systémů
- Stanovení RTO/RPO
- Identifikace single points of failure
- Definice recovery priorit
Další kroky
- Zpět na DORA přehled
- DORA Scope
- DORA Checklist
Zdroje