{"release":{"id":"2d86bd12ba77a288053b34ea2517324b92d03c8039b7f5d156fa4002421384a1","published":"2026-11-10T16:06:46Z","pinned":false},"limits":{"coverage":{"history":"full","held_since":"2022-12-27","gaps":[],"covered":["DORA L1"],"not_covered":["national guidance","court decisions"]},"freshness":{"release_id":"2d86bd12ba77a288053b34ea2517324b92d03c8039b7f5d156fa4002421384a1","release_published":"2026-11-10T16:06:46Z","checked_at":"2026-11-09","checked_against":"EUR-Lex"},"truncation":null,"failures":[],"incomplete":[]},"page":{"path":"/dora/articles/1","url":"https://www.headlesslaw.com/dora/articles/1","title":"Article 1 — Subject matter","family":"l1_hand","work_id":"dora","status":"in_force","force_status":"in_force","date_state":"current","requested_date":null,"as_of":"2026-11-11","applies_from":"2025-01-17","application":{"state":"applicable","next":null,"dates":[{"at":"2025-01-17","note":"Article 64"}]},"version_label":"Regulation (EU) 2022/2554, OJ L 333, 27.12.2022","check":{"against":"EUR-Lex","on":"2026-11-09"},"check_result":"matched","official_url":"https://eur-lex.europa.eu/eli/reg/2022/2554/oj/eng","valid_from":"2022-12-27","valid_until":null,"revision":1,"content_id":"b601314be4630b88","change_date":null,"nearest_versions":["2022-12-27"],"first_text_date":"2022-12-14","correction_applies":false,"versions":["2022-12-27"],"version_url":"https://www.headlesslaw.com/dora/articles/1/versions/2022-12-27","revision_url":"https://www.headlesslaw.com/dora/articles/1/versions/2022-12-27/rev/b601314be4630b88","versions_url":"https://www.headlesslaw.com/dora/articles/1/versions","relations_url":"https://www.headlesslaw.com/dora/articles/1/relations","source_line":null,"attribution":null},"provenance":{"official_url":"https://eur-lex.europa.eu/eli/reg/2022/2554/oj/eng","check":{"result":"matched","checked_at":"2026-11-09","against":"EUR-Lex"},"repo_path":null,"body_sha256":"c9089ad88a383ad57e15125be3b4d69bc6a1f8847b06bb9f1af05a38a94f3755","markdown_sha256":"9410fc3448a5b3642f8d773cd44a55f60b9a2b47670511e2d47c510017ba7573"},"units":[{"locator":"dora/art/1","kind":"article","status":"in_force","label":null,"heading":"Subject matter","text":"","marks":[],"revision":1,"text_hash":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","reason":null},{"locator":"dora/art/1/para/1","kind":"paragraph","status":"in_force","label":"1.","heading":null,"text":"In order to achieve a high common level of digital operational resilience, this Regulation lays down uniform requirements concerning the security of network and information systems supporting the business processes of financial entities as follows:","marks":[],"revision":1,"text_hash":"8f81beef2af1bdd098dd8e147a491242e68fa25cd741d374311b956d8b2b82b3","reason":null},{"locator":"dora/art/1/para/1/pt/a","kind":"point","status":"in_force","label":"(a)","heading":null,"text":"requirements applicable to financial entities in relation to:","marks":[],"revision":1,"text_hash":"71ab4eb40f762c48a7b051111c40e3cfce9030ec71fe01c56a2001c77408a6db","reason":null},{"locator":"dora/art/1/para/1/pt/a/subpt/i","kind":"subpoint","status":"in_force","label":"(i)","heading":null,"text":"information and communication technology (ICT) risk management;","marks":[],"revision":1,"text_hash":"34a0dccf63f7a2b01dd971397886fdd6465a44dc1d591c95bde3fa764d060438","reason":null},{"locator":"dora/art/1/para/1/pt/a/subpt/ii","kind":"subpoint","status":"in_force","label":"(ii)","heading":null,"text":"reporting of major ICT-related incidents and notifying, on a voluntary basis, significant cyber threats to the competent authorities;","marks":[],"revision":1,"text_hash":"fd95abe917182ecedc1d66040cd70dabf43621f4a3114fbe8b8231f4e8b7fec2","reason":null},{"locator":"dora/art/1/para/1/pt/a/subpt/iii","kind":"subpoint","status":"in_force","label":"(iii)","heading":null,"text":"reporting of major operational or security payment-related incidents to the competent authorities by financial entities referred to in Article 2(1), points (a) to (d);","marks":[],"revision":1,"text_hash":"3169a55007173c9c7296d0206a23a71b13b3f802d6d9f7b39da14e3d880b5787","reason":null},{"locator":"dora/art/1/para/1/pt/a/subpt/iv","kind":"subpoint","status":"in_force","label":"(iv)","heading":null,"text":"digital operational resilience testing;","marks":[],"revision":1,"text_hash":"8b0c112b898434cc6536dac228f4991173d07a64453b4d17d6b5b0c15c55c647","reason":null},{"locator":"dora/art/1/para/1/pt/a/subpt/v","kind":"subpoint","status":"in_force","label":"(v)","heading":null,"text":"information and intelligence sharing in relation to cyber threats and vulnerabilities;","marks":[],"revision":1,"text_hash":"b21bce2df3715fda6fcf79ebcfb820265babc8a97b6d7125de70b2668d0fa198","reason":null},{"locator":"dora/art/1/para/1/pt/a/subpt/vi","kind":"subpoint","status":"in_force","label":"(vi)","heading":null,"text":"measures for the sound management of ICT third-party risk;","marks":[],"revision":1,"text_hash":"161985f507cc62216eabc281bf25328fc5020ab91df1d6c37d24f5ef7e1a0904","reason":null},{"locator":"dora/art/1/para/1/pt/b","kind":"point","status":"in_force","label":"(b)","heading":null,"text":"requirements in relation to the contractual arrangements concluded between ICT third-party service providers and financial entities;","marks":[],"revision":1,"text_hash":"40e74129531f15fb68edc790a200a40fc015571b5995da4acb93ce8593d5a5f1","reason":null},{"locator":"dora/art/1/para/1/pt/c","kind":"point","status":"in_force","label":"(c)","heading":null,"text":"rules for the establishment and conduct of the Oversight Framework for critical ICT third-party service providers when providing services to financial entities;","marks":[],"revision":1,"text_hash":"b3f97353b104b3ffe268222916d9cacf95d7c47d45ecf1817dcdbffcf5e60836","reason":null},{"locator":"dora/art/1/para/1/pt/d","kind":"point","status":"in_force","label":"(d)","heading":null,"text":"rules on cooperation among competent authorities, and rules on supervision and enforcement by competent authorities in relation to all matters covered by this Regulation.","marks":[],"revision":1,"text_hash":"3b57f33af30666f67bcda4406697613a078449b85890cf6b07c5e47eca9a0e19","reason":null},{"locator":"dora/art/1/para/2","kind":"paragraph","status":"in_force","label":"2.","heading":null,"text":"In relation to financial entities identified as essential or important entities pursuant to national rules transposing Article 3 of Directive (EU) 2022/2555, this Regulation shall be considered a sector-specific Union legal act for the purposes of Article 4 of that Directive.","marks":[],"revision":1,"text_hash":"149d5d1179c4a3f24555547c3eb63667edaf635dfe865177c1c997dcfe85ee50","reason":null},{"locator":"dora/art/1/para/3","kind":"paragraph","status":"in_force","label":"3.","heading":null,"text":"This Regulation is without prejudice to the responsibility of Member States’ regarding essential State functions concerning public security, defence and national security in accordance with Union law.","marks":[],"revision":1,"text_hash":"a765934900ff8ffa030859b22759e227e51da90d224461fa4f18045dc925b368","reason":null}],"markdown":"*In force · Regulation (EU) 2022/2554, OJ L 333, 27.12.2022 · Verified 9 Nov 2026 · [Official source](https://eur-lex.europa.eu/eli/reg/2022/2554/oj/eng)*\n\n1. <a id=\"p-1\"></a>In order to achieve a high common level of [digital operational resilience](https://www.headlesslaw.com/definitions/dora/digital-operational-resilience), this Regulation lays down uniform requirements concerning the [security of network and information systems](https://www.headlesslaw.com/definitions/dora/security-of-network-and-information-systems) supporting the business processes of financial entities as follows:\n\n    <a id=\"p-1-a\"></a>**(a)** requirements applicable to financial entities in relation to:\n\n    <a id=\"p-1-a-i\"></a>**(i)** information and communication technology (ICT) risk management;\n\n    <a id=\"p-1-a-ii\"></a>**(ii)** reporting of [major ICT-related incidents](https://www.headlesslaw.com/definitions/dora/major-ict-related-incident) and notifying, on a voluntary basis, [significant cyber threats](https://www.headlesslaw.com/definitions/dora/significant-cyber-threat) to the competent authorities;\n\n    <a id=\"p-1-a-iii\"></a>**(iii)** reporting of [major operational or security payment-related incidents](https://www.headlesslaw.com/definitions/dora/major-operational-or-security-payment-related-incident) to the competent authorities by financial entities referred to in [Article 2(1)](2.md), points (a) to (d);\n\n    <a id=\"p-1-a-iv\"></a>**(iv)** [digital operational resilience](https://www.headlesslaw.com/definitions/dora/digital-operational-resilience) testing;\n\n    <a id=\"p-1-a-v\"></a>**(v)** information and intelligence sharing in relation to [cyber threats](https://www.headlesslaw.com/definitions/dora/cyber-threat) and [vulnerabilities](https://www.headlesslaw.com/definitions/dora/vulnerability);\n\n    <a id=\"p-1-a-vi\"></a>**(vi)** measures for the sound management of [ICT third-party risk](https://www.headlesslaw.com/definitions/dora/ict-third-party-risk);\n\n    <a id=\"p-1-b\"></a>**(b)** requirements in relation to the contractual arrangements concluded between [ICT third-party service providers](https://www.headlesslaw.com/definitions/dora/ict-third-party-service-provider) and financial entities;\n\n    <a id=\"p-1-c\"></a>**(c)** rules for the establishment and conduct of the Oversight Framework for [critical ICT third-party service providers](https://www.headlesslaw.com/definitions/dora/critical-ict-third-party-service-provider) when providing services to financial entities;\n\n    <a id=\"p-1-d\"></a>**(d)** rules on cooperation among competent authorities, and rules on supervision and enforcement by competent authorities in relation to all matters covered by this Regulation.\n2. <a id=\"p-2\"></a>In relation to financial entities identified as essential or important entities pursuant to national rules transposing Article 3 of Directive (EU) 2022/2555, this Regulation shall be considered a sector-specific Union legal act for the purposes of Article 4 of that Directive.\n3. <a id=\"p-3\"></a>This Regulation is without prejudice to the responsibility of Member States’ regarding essential State functions concerning public security, defence and national security in accordance with Union law.\n\n***\n\n[Chapter I — General provisions](../chapters/i.md) · [Article 2 →](2.md)\n"}