Subject Matter
Obligation to apply the ICT risk managment (Art. 5-15) and/or the simplified ICT risk management framework for entities that hold two or more licences.
Question
Is a small and non-interconnected investment firm (Art. 12 (1) IFR (Regulation (EU) 2019/2033)) that also holds a licence as a crowdfunding service provider according to Art. 12 ECSPR (Regulation (EU) 2020/1503) obligated to apply Art. 5-15 DORA or is it allowed to use the simplified ICT risk management framework of Art. 16 DORA?
Level 1 Regulation
Regulation (EU) 2022/2554 - The Digital Operational Resilience Act (DORA)