Is a small and non-interconnected investment firm (Art. 12 (1) IFR (Regulation (EU) 2019/2033)) that also holds a licence as a crowdfunding service provider according to Art. 12 ECSPR (Regulation (EU) 2020/1503) obligated to apply Art. 5-15 DORA or is it allowed to use the simplified ICT risk management framework of Art. 16 DORA?