Submission of data for the audit of the risk management framework for information and communication technology pursuant to DORA

1 July 2026
Ref.: 2606180

Circular no.: 23/2026
To: Commercial banks, savings banks, credit undertakings, payment institutions, electronic money institutions, securities firms, management companies of securities funds, pension funds, licensed operators of specialised funds, insurance companies, virtual asset service providers, central securities depositories, trading venues, the Association of Companies in Financial Services and the National Association of Pension Funds

Subject: Submission of data for the audit of the risk management framework for information and communication technology pursuant to DORA

The Financial Supervisory Authority of the Central Bank of Iceland monitors that the activities of supervised entities are in accordance with laws, regulations, rules or resolutions applicable to the activities and that the activities are otherwise in accordance with sound and healthy business practices, cf. the first paragraph of Article 8 of Act No. 87/1998 on official supervision of financial activities.

In view of the aforementioned role of the Financial Supervisory Authority and the first paragraph of Article 9 of Act No. 87/1998, information is requested to assess compliance with the requirements for the management of information and communication technology risk set out in Regulation (EU) 2022/2554 on digital operational resilience for the financial sector (DORA), cf. Act No. 78/2025 on digital operational resilience of the financial market, and the Central Bank of Iceland's rules No. 310/2026 on the same subject. More specifically, a report is requested on the audit of the risk management framework pursuant to the fifth paragraph of Article 6 and the second paragraph of Article 16. DORA and the assessment of compliance, as further detailed below.

1. Report on the audit of the risk management framework for information and communication technology

The management of information and communication technology risk is discussed in Articles 5-16. DORA. It states that financial market participants shall have in place a sound, comprehensive and well-documented risk management framework for information and communication technology. According to Article 36 g of Act No. 129/1997 on mandatory insurance of pension rights and the activities of pension funds, pension funds fall under the requirements of Articles 5-14. DORA. The provisions of DORA on the management of information and communication technology risk are further specified in Regulation (EU) 2024/1774, which is implemented in the Central Bank's rules No. 310/2026.

The requirements of DORA take into account the size, overall risk profile, nature, scope and complexity of the activities of financial market participants in accordance with the proportionality principle of Article 4 of the Regulation. The proportionality principle affects how detailed the entities need to comply with individual DORA requirements, including on risk management. In this context, it differs whether entities fall under the requirements for a general risk management framework pursuant to Articles 5-15 or a simplified risk management framework pursuant to Article 16. DORA.

The risk management framework for information and communication technology shall be reviewed at least once a year, or regularly in the case of microenterprises, as well as when serious incidents related to information and communication technology occur and following supervisory instructions or findings resulting from tests or audit processes on digital resilience. Entities shall submit a report on the review of the framework to the competent authority if requested, cf. the fifth paragraph of Article 6 of the Regulation. The presentation and content of the report shall be in accordance with Article 27 of Regulation (EU) 2024/1774. Entities that fall under the requirements for a simplified risk management framework shall review the framework regularly and may submit a report on that review if requested by the competent authority, cf. the second paragraph of Article 16. DORA. The presentation and content of the report are governed by Article 41 of Regulation (EU) 2024/1774.

2. Data requested and templates

To assess the implementation of and compliance with the DORA requirements on the management of information and communication technology risk, the Financial Supervisory Authority requests a report on the audit of the risk management framework pursuant to the fifth paragraph of Article 6 and the second paragraph of Article 16. DORA, cf. Articles 27 and 41 of Regulation (EU) 2024/1774. A request is also made for the results of the compliance assessment pursuant to point ii of subparagraph l of the second paragraph of Article 27 of Regulation (EU) 2024/1774 on the appropriate template.

No compliance assessment is requested from entities that fall under the requirements for a simplified risk management framework pursuant to Article 16. DORA.

The Financial Supervisory Authority has prepared standard templates for the report on the audit of the risk management framework for information and communication technology, on the one hand on the basis of Article 27 of Regulation (EU) 2024/1774 and on the other hand on the basis of Article 41 of the same Regulation. A template in Excel format has also been prepared for the compliance assessment pursuant to point ii of subparagraph l of the second paragraph of Article 27 of Regulation (EU) 2024/1774.

The templates are intended to promote consistent information provision and facilitate the submission for entities. Entities are, however, not bound to use the template for the report on the audit of the risk management framework for information and communication technology, provided that the report contains all the items required under Regulation (EU) 2024/1774 in a searchable electronic format.

New submission cases will be prepared in the Central Bank's data submission system under the names "Report on audit (DORA)" and "Compliance assessment with DORA".

3. Submission frequency

In view of the proportionality principle of DORA, entities shall submit the aforementioned data at different frequencies. Commercial banks, savings banks, credit undertakings, payment institutions, stock exchanges and other trading venues, electronic money institutions, insurance companies, central securities depositories and virtual asset service providers shall submit the data annually. The first submission will be on 28 February 2027.

Other entities shall generally submit the data every three years. The first submission will be on 28 February 2029. However, the Financial Supervisory Authority will request more frequent submissions from certain entities due to the size, nature or scope of their activities, but they will be specifically notified of the submission frequency.

It should be noted that the Financial Supervisory Authority may request this data outside the regular submission frequency if deemed appropriate, such as due to regular supervision, serious incidents related to information and communication technology, significant changes in activities or other factors that may affect the digital operational resilience of the entity concerned, cf. the fifth paragraph of Article 6 and the second paragraph of Article 16. DORA.

4. Discontinuation of submissions

With the introduction of these data submissions, the following submissions shall cease to be valid for the recipients of this circular:

• Assessment of compliance with guiding recommendation No. 1/2019 on the management of information and communication technology risk and security risk.

• Assessment of compliance with EIOPA guidelines on information and communication technology security and governance (EIOPA-BoS-20/600).

• Assessment of compliance with EBA guidelines on the management of information and communication technology risk and security risk (EBA/GL/2019/04).

Further instructions on completing the data can be found in the templates that accompany the reporting cases.

Inquiries regarding the data reporting can be sent to olafur.hlynsson@sedlabanki.is.

Yours faithfully,
CENTRAL BANK OF ICELAND

Gísli Óttarsson
Executive Director
Prudential Supervision

Ólafur Hlynsson
Specialist
Prudential Supervision