ICT-recovery in the asset management sector

In brief - The risk of disruptions and ICT failures is increasing. Therefore, it is important that financial institutions can restore their ICT quickly and effectively. This ability to bring systems, data, and processes back into operation after a disruption or failure is also known as ICT-recovery. The AFM has investigated how five large institutional asset managers have structured their ICT-recovery and how well they are prepared to restore ICT after a disruption or failure. The AFM asks all asset managers to study the points for attention in the report and to address them where necessary.

SEPTEMBER | 2026

Summary

Financial institutions are increasingly dependent on ICT for their services. At the same time, risks are increasing, for example due to cyberattacks, geopolitical tensions, and applications of new artificial intelligence (AI). AI can, for example, be used to detect vulnerabilities in systems faster. To address these risks in a uniform manner throughout the European Union, the Digital Operational Resilience Act (DORA) has been fully in force since January 2025. DORA sets requirements for financial institutions, including asset managers, to strengthen their digital resilience.

Digital resilience has been an important priority in supervision for years. Financial institutions must not only take measures to prevent ICT disruptions, but also be able to restore their ICT quickly if systems fail. The entire set of processes, measures, and provisions to bring systems, data, and services back into operation after a disruption or failure is also known as ICT-recovery. To gain more insight into the structure of ICT-recovery, research was conducted among a number of large institutional asset managers.

The research shows that these asset managers are broadly prepared for ICT failures. At the same time, there are points for attention that can contribute to a more effective structure of ICT-recovery:

Ensure consistent identification and classification of (critical) functions;
Define recovery objectives for functions;
Include own recovery requirements in contracts with ICT service providers;
Test recovery objectives based on various extreme scenarios.

Asset managers are asked to study these points for attention and implement improvements where necessary.

Summary 2
Table of Contents 3

DORA and components of ICT-recovery 4
Background of the exploratory research 5
Points for attention regarding ICT-recovery 6
Point for attention 1: Ensure consistent identification and classification of (critical) functions 6 Point for attention 2: Define recovery objectives for functions 6 Point for attention 3: Include own recovery requirements in contracts with ICT service providers 6 Point for attention 4: Test recovery objectives based on various extreme scenarios 7
Conclusion 8
Appendix 1 Key provisions 9
Appendix 2 Definitions 10

1. DORA and components of ICT-recovery

DORA aims to strengthen the digital resilience of financial institutions. It focuses in particular on measures to limit the risks surrounding disruptions and ICT failures at financial institutions as much as possible. This includes failures due to a cyberattack, or a calamity, but also human errors. Part of this includes requirements focused on business continuity, response to disruptions, and the restoration of ICT during disruptions such as ICT failure (ICT-recovery).

DORA requires financial institutions to structure and document various components of their ICT-recovery. The most important components are explained below:

Business Impact Analysis (BIA): An analysis must be made of the impact that disruptions to business activities have on the financial institution. The BIA takes into account the critical nature of identified and mapped functions, support processes, dependencies on third parties, and information assets, and their interdependencies;
Recovery objectives: Under DORA, this refers to the Recovery Time Objective (RTO, or maximum acceptable recovery time) and the Recovery Point Objective (RPO, or maximum acceptable data loss expressed in time) of the functions. The financial institution sets these recovery objectives per function. In setting these, the financial institution also takes into account the consequences of disruptions and the relevant dependencies that emerge from the BIA;
ICT response and recovery plan (ICT recovery plan): Here, a financial institution describes for each relevant function or ICT asset the measures necessary to restore the situation in the event of ICT failure. This includes, among other things, which processes must be restored, the order of restoration, measures such as redundant provisions, backup locations, and backups, and governance. The ICT recovery plan must be structured in such a way that the established recovery objectives can be met;
(ICT) business continuity plan (BCP): Here, the financial institution describes the measures by which the institution can continue its business operations during disruptions or ICT failures. This includes, for example, alternative working methods;
Communication plan: In the event of disruptions or failures, it is necessary to have considered communication, both to internal and external stakeholders. This must be documented in a plan, including clear roles, responsibilities, and procedures, and is dependent on the severity of the disruption or failure;
Testing: Regular testing makes it clear whether the ICT systems that support functions can actually be restored within the set recovery objectives and whether employees know their tasks. The results of these tests are used to further improve the structure of ICT-recovery.

2. Background of the exploratory research

For this exploratory research into ICT-recovery, five institutional asset managers were investigated. The research is based on document research and conversations with these institutions. The goal was to gain insight into how they are prepared for ICT failures and the restoration thereof. For effective ICT-recovery, it is important that institutions have a good overview of their functions, information assets, and ICT assets, including their interdependencies. Recovery objectives must also be established. These form the basis for measures that support the continuity of services and contribute to a quick restoration after ICT failure.

The points for attention in this report are largely based on general principles for ICT-recovery and are therefore in principle relevant for all asset managers. The extent to which institutions must elaborate on these points for attention depends on their nature, size, and complexity. Proportionality is not discussed further in this report.

3. Points for attention regarding ICT-recovery

The investigated asset managers are broadly prepared for ICT failures. The research also shows that improvements are possible in several areas of ICT-recovery. The four points for attention in this report offer handles for further strengthening digital resilience. Asset managers are asked to address these points for attention where necessary.

Point for attention 1: Ensure consistent identification and classification of (critical) functions

Financial institutions must identify, classify, and document all ICT-supported functions. This also includes dividing functions into critical and non-critical functions. Long-term failure of a critical function can lead to unacceptable damage for the financial institution itself, counterparties, and/or customers. To prevent such damage, strict control measures must be in place for critical functions that are proportional to the recovery objectives, including control measures for ICT business continuity. All asset managers in the research had an overview of critical functions. It was noted that in the overviews assessed by the AFM, the classification of these functions did not always correspond to the classification the asset managers had used in the request for the DORA information register in 2026.

The AFM points out that consistency in this area is important. Inconsistencies in defining critical functions can lead to functions being incorrectly viewed as non-critical. Specifically for ICT business continuity, this could mean that the control measures taken prove insufficient in the event of a serious disruption, resulting in insufficiently quick restoration or too much data loss.

Point for attention 2: Define recovery objectives for functions

Financial institutions must establish recovery objectives. Recovery objectives indicate when and under what conditions a function must be able to be operational again. The AFM regularly observed in the research that recovery objectives were set on individual ICT assets, but not separately on the functions supported by the ICT assets.

It is important to establish recovery objectives for functions for several reasons. First, asset managers must have clear insight into how quickly functions can be restored after the failure of one or more ICT assets or ICT services and whether this meets the recovery objective of the function. Secondly, it is important that it is clear which ICT assets contribute to critical functions. Blind spots regarding which ICT assets are critical can mean insufficiently controlled risks regarding ICT business continuity.

Point for attention 3: Include own recovery requirements in contracts with ICT service providers

Financial institutions outsource a lot of ICT services. This includes, for example, specialized software and cloud providers. Due to this outsourcing, there is often a large dependency on ICT service providers. Due to the complexity of the ICT organization and the increased chance of cyberattacks, good agreements with third parties are essential for the risk management of the financial institution.

Part of this includes the institution's requirements for ICT-recovery. In the selection and documentation of agreements with ICT service providers, it is therefore important for financial institutions to check whether the outsourcing also fits within its recovery objectives for the function or functions supported by the outsourced ICT. This includes the time a function can be unavailable before unacceptable damage occurs. Financial institutions must check whether that objective can also be met after outsourcing. In the research, the AFM observed that asset managers did not always explicitly document these recovery objectives in an agreement (including a service level agreement).

Making and documenting agreements with ICT service providers on factors important to restoring the functions of financial institutions within the recovery objectives is important for controlling restoration risks. Especially in the case of critical functions, the AFM expects financial institutions to document concrete agreements in the agreement with ICT service providers that fit the recovery objectives they have established for the relevant function(s).

Point for attention 4: Test recovery objectives based on various extreme scenarios

Financial institutions must establish recovery objectives that are also feasible in extreme scenarios. The recovery objectives must be included in the recovery plans. Additionally, relevant scenarios must be mentioned in the recovery plans that are taken into account when establishing the measures in the recovery plans. In this, financial institutions must in any case take into account at least nine scenarios prescribed by DORA.

Testing these recovery plans must be carried out based on test scenarios that simulate potential disruptions, including an adequate range of severe but plausible scenarios. The tests also include scenarios for switching from primary ICT infrastructure to redundant capacity, backups, and redundant facilities.

The AFM notes that all asset managers in the research have a test program in which various scenarios are tested. However, the AFM sees differences in the scope and depth of the tests carried out. For example, the transfer from the primary to the secondary data center was tested in all cases. In the other tests, some asset managers focused on the failure of a specific system, where this test was repeated periodically. Other asset managers tested multiple scenarios in which different systems were unavailable.

The AFM expects financial institutions to test recovery plans, including the recovery objectives, over the years using sufficiently different scenarios. It is important that financial institutions take into account the scenarios involved in the design of the recovery plan and the results of the risk analysis. The test program must provide sufficient insight into whether critical or important functions can be restored within the established recovery objectives. It is therefore important not only to test whether different functions can be restored after a cyberattack, but also whether restoration is possible for other relevant causes of disruptions.

4. Conclusion

DORA focuses on the digital operational resilience of financial institutions. Due to technological and societal developments, digital threats are further increasing. The AFM finds it of great importance to gain better insight into how institutions can restore their ICT with minimal damage after it fails. Therefore, in addition to research into ICT risk management, the AFM has now also conducted exploratory research into ICT-recovery 1.

Important points for attention are:

Ensure consistent identification and classification of (critical) functions within the institution
Define recovery objectives for functions
Include own recovery requirements in contracts with ICT service providers
Take various extreme scenarios into account when testing recovery objectives.

The AFM considers these points relevant for other asset managers and shares them in this report. The points for attention may also be relevant for other financial enterprises.

The AFM asks asset managers to study the points for attention in the report and to address them where necessary.

1 See Trading systems require sharper ICT risk management under DORA, focused on trading systems but with recommendations that may also be relevant for other financial institutions.

Appendix 1 Key provisions

Subject	DORA	Delegated Regulation Risk Management
Definitions	Article 3	-
Consistent identification and classification	Article 8, paragraph 1, 3, 4, and 6	Article 4, paragraph 2, sub b
Recovery objectives for functions	Article 12, paragraph 6	Article 24, paragraph 1, sub b, item ii, point 2
Recovery requirements in third-party contracts	Article 30, paragraph 3 sub c	-
Testing with various extreme scenarios	Article 11, paragraph 6	Article 24, paragraph 2, sub b (iv) <br> Article 25, paragraph 2, sub a <br> Article 26, paragraph 2

Appendix 2 Definitions

What is a critical or important function (critical function)? A function whose disruption would substantially impair the financial performance of a financial institution or the solidity or continuity of its services and activities, or whose termination or defective or failed execution would substantially impair the permanent compliance by a financial institution with the conditions and obligations under its license or its other obligations under applicable financial services law.

What are recovery objectives? These consist in DORA of an RTO (Recovery Time Objective) and RPO (Recovery Point Objective).

What is an RTO? The maximum duration within which a system, process, or service must be restored after a disruption, before unacceptable consequences occur for the organization.

What is an RPO? The point in time to which data must be restorable after a disruption; i.e., the maximum acceptable amount of data loss, expressed in time.

What is an ICT service provider? An undertaking that provides ICT services.

What is an ICT service? A digital and data service that is continuously provided via ICT systems to one or more internal or external users, including hardware as a service and hardware services, including the provision of technical support via software or firmware updates by the hardware provider, with the exception of traditional analog telephone services. Various types of ICT services are included in Annex III of Delegated Regulation (EU) 2024/2956 on the Information Register.