EU-DORA
Regulation (EU) 2022/2554 — Digital Operational Resilience Act
- Ch. I — General Provisions
- Art. 1. Subject matter (8)
- Art. 2. Scope (4)
- Art. 3. Definitions ref
- Art. 4. Proportionality principle (3)
- Ch. II — ICT Risk Management
- Art. 5. Governance and organisation (37)
- Art. 6. ICT risk management framework (23)
- Art. 7. ICT systems, protocols and tools (4)
- Art. 8. Identification (10)
- Art. 9. Protection and prevention (17)
- Art. 10. Detection (7)
- Art. 11. Response and recovery (23)
- Art. 12. Backup policies and procedures, restoration and recovery procedures and methods (19)
- Art. 13. Learning and evolving (16)
- Art. 14. Communication (4)
- Art. 15. Further harmonisation of ICT risk management tools, methods, processes and policies (10)
- Art. 16. Simplified ICT risk management framework (13)
- Ch. III — ICT-Related Incident Management, Classification and Reporting
- Art. 17. ICT-related incident management process (9)
- Art. 18. Classification of ICT-related incidents and cyber threats (7)
- Art. 19. Reporting of major ICT-related incidents and voluntary notification of significant cyber threats (18)
- Art. 20. Harmonisation of reporting content and templates (7)
- Art. 21. Centralisation of reporting of major ICT-related incidents (9)
- Art. 22. Supervisory feedback (6)
- Art. 23. Operational or security payment-related incidents concerning credit institutions, payment institutions, account information service providers, and electronic money institutions (2)
- Ch. IV — Digital Operational Resilience Testing
- Art. 24. General requirements for the performance of digital operational resilience testing (8)
- Art. 25. Testing of ICT tools and systems (3)
- Art. 26. Advanced testing of ICT tools, systems and processes based on TLPT (14)
- Art. 27. Requirements for testers for the carrying out of TLPT (9)
- Ch. V — Managing ICT Third-Party Risk
- Art. 28. General principles (26)
- Art. 29. Preliminary assessment of ICT concentration risk at entity level (7)
- Art. 30. Key contractual provisions (24)
- Art. 31. Designation of critical ICT third-party service providers (16)
- Art. 32. Structure of the Oversight Framework (11)
- Art. 33. Tasks of the Lead Overseer (18)
- Art. 34. Operational coordination between Lead Overseers (4)
- Art. 35. Powers of the Lead Overseer (19)
- Art. 36. Exercise of the powers of the Lead Overseer outside the Union (15)
- Art. 37. Request for information (15)
- Art. 38. General investigations (10)
- Art. 39. Inspections (8)
- Art. 40. Ongoing oversight (7)
- Art. 41. Harmonisation of conditions enabling the conduct of the oversight activities (5)
- Art. 42. Follow-up by competent authorities (14)
- Art. 43. Oversight fees (3)
- Art. 44. International cooperation (2)
- Ch. VI — Information-Sharing Arrangements
- Art. 45. Information-sharing arrangements on cyber threat information and intelligence (3)
- Ch. VII — Competent Authorities
- Art. 46. Competent authorities (17)
- Art. 47. Cooperation with structures and authorities established by Directive (EU) 2022/2555 (7)
- Art. 48. Cooperation between authorities (2)
- Art. 49. Financial cross-sector exercises, communication and cooperation (5)
- Art. 50. Administrative penalties and remedial measures (14)
- Art. 51. Exercise of the power to impose administrative penalties and remedial measures (9)
- Art. 52. Criminal penalties (2)
- Art. 53. Notification duties (2)
- Art. 54. Publication of administrative penalties (8)
- Art. 55. Professional secrecy (4)
- Art. 56. Data Protection (3)
- Ch. VIII — Delegated Acts
- Art. 57. Exercise of the delegation (3)
- Ch. IX — Transitional and Final Provisions
- Art. 58. Review clause (7)
- Art. 59. Amendments to Regulation (EC) No 1060/2009 (5)
- Art. 60. Amendments to Regulation (EU) No 648/2012 (7)
- Art. 61. Amendments to Regulation (EU) No 909/2014 (6)
- Art. 62. Amendments to Regulation (EU) No 600/2014 (3)
- Art. 63. Amendment to Regulation (EU) 2016/1011 (4)
- Art. 64. Entry into force and application (1)
Chapter I — General Provisions
Chapter II — ICT Risk Management
Chapter III — ICT-Related Incident Management, Classification and Reporting
Chapter IV — Digital Operational Resilience Testing
Chapter V — Managing ICT Third-Party Risk
Article 28. General principles
22 obligations
EU-DORA-28-05
Documentation
Include policy on critical/important ICT services in third-party risk strategy
The ICT third-party risk strategy must include a policy on the use of ICT services supporting critical or important func
EU-DORA-28-06
Monitoring
Management body regular risk review for critical/important functions
The management body must regularly review risks identified in respect to contractual arrangements on the use of ICT serv
EU-DORA-28-07
Documentation
Maintain and update register of ICT service contractual arrangements
Financial entities must maintain and update at entity, sub-consolidated and consolidated levels a register of informatio
EU-DORA-28-08
Documentation
Appropriately document contractual arrangements with distinction
Contractual arrangements must be appropriately documented, distinguishing between those that cover ICT services supporti
EU-DORA-28-09
Reporting
Report yearly on new ICT service arrangements
Financial entities must report at least yearly to competent authorities on the number of new arrangements on the use of
EU-DORA-28-10
Transparency
Make register available to competent authority upon request
Financial entities must make available to the competent authority, upon its request, the full register of information or
EU-DORA-28-11
Transparency
Inform competent authority of planned critical/important arrangements
Financial entities must inform the competent authority in a timely manner about any planned contractual arrangement on t
EU-DORA-28-12
Requirement
Assess if contractual arrangement covers critical/important function
Before entering into contractual arrangements for ICT services, financial entities must assess whether the arrangement c
EU-DORA-28-13
Requirement
Assess if supervisory conditions for contracting are met
Before entering into contractual arrangements for ICT services, financial entities must assess if supervisory conditions
EU-DORA-28-14
Risk Management
Identify and assess all relevant risks including concentration risk
Before entering into contractual arrangements for ICT services, financial entities must identify and assess all relevant
EU-DORA-28-15
Requirement
Undertake due diligence on prospective ICT third-party service providers
Before entering into contractual arrangements for ICT services, financial entities must undertake all due diligence on p
EU-DORA-28-16
Risk Management
Identify and assess conflicts of interest from contractual arrangement
Before entering into contractual arrangements for ICT services, financial entities must identify and assess conflicts of
EU-DORA-28-17
Requirement
Only contract with providers complying with appropriate information security standards
Financial entities may only enter into contractual arrangements with ICT third-party service providers that comply with
EU-DORA-28-18
Requirement
Consider highest quality security standards for critical/important functions
For contractual arrangements concerning critical or important functions, financial entities must take due consideration
EU-DORA-28-19
Monitoring
Pre-determine audit frequency and areas using risk-based approach
In exercising access, inspection and audit rights over ICT third-party service providers, financial entities must pre-de
EU-DORA-28-20
Requirement
Verify auditor skills for technically complex arrangements
For contractual arrangements with high technical complexity, financial entities must verify that auditors (internal, ext
EU-DORA-28-21
Requirement
Ensure contractual arrangements may be terminated in specified circumstances
Financial entities must ensure that contractual arrangements on the use of ICT services may be terminated in circumstanc
EU-DORA-28-22
Requirement
Put in place exit strategies for critical/important functions
For ICT services supporting critical or important functions, financial entities must put in place exit strategies that t
EU-DORA-28-23
Requirement
Ensure ability to exit without disruption, compliance limitation, or service detriment
Financial entities must ensure they can exit contractual arrangements without disruption to business activities, limitin
EU-DORA-28-24
Documentation
Maintain comprehensive, documented, tested and reviewed exit plans
Exit plans must be comprehensive, documented and, in accordance with Article 4(2) criteria, sufficiently tested and revi
EU-DORA-28-25
Requirement
Identify alternative solutions and develop transition plans
Financial entities must identify alternative solutions and develop transition plans enabling them to remove contracted I
EU-DORA-28-26
Requirement
Have appropriate contingency measures for business continuity
Financial entities must have appropriate contingency measures in place to maintain business continuity in the event of c
Article 29. Preliminary assessment of ICT concentration risk at entity level
3 obligations
EU-DORA-29-01
Risk Management
Assess non-substitutable ICT provider risk
When performing identification and assessment of risks under Article 28(4)(c), financial entities must consider whether
EU-DORA-29-02
Risk Management
Assess concentration risk from multiple arrangements
When performing identification and assessment of risks under Article 28(4)(c), financial entities must consider whether
EU-DORA-29-03
Risk Management
Weigh benefits and costs of alternative solutions
Financial entities must weigh the benefits and costs of alternative solutions, such as using different ICT third-party s