{"release":{"id":"2d86bd12ba77a288053b34ea2517324b92d03c8039b7f5d156fa4002421384a1","published":"2026-11-10T16:06:46Z","pinned":false},"limits":{"coverage":{"history":"full","held_since":"2022-12-27","gaps":[],"covered":["DORA L1"],"not_covered":["national guidance","court decisions"]},"freshness":{"release_id":"2d86bd12ba77a288053b34ea2517324b92d03c8039b7f5d156fa4002421384a1","release_published":"2026-11-10T16:06:46Z","checked_at":null,"checked_against":null},"truncation":{"shown":34,"total":34,"capped":false,"cap":1000,"next_cursor":null},"failures":[],"incomplete":[]},"page":{"path":"/dora/articles/11","url":"https://www.headlesslaw.com/dora/articles/11","title":"Article 11 — Response and recovery","work_id":"dora","date_state":"past","as_of":"2025-01-17","relations_url":"https://www.headlesslaw.com/dora/articles/11/relations"},"as_of":"2025-01-17","counts":{"refers_to:out":10,"uses_term:out":18,"refers_to:in":5,"guides:in":1},"relations":[{"edge_id":"4bc1a6c2f5a64b19dc18","scope":"unit","type":"refers_to","direction":"out","resolution":"resolved","basis":"explicit_legal_cross_reference","method":"extracted_relationships","confidence":"medium","src_from":"2022-12-27","src_until":null,"span":"Article 19","dst_raw":"eu.dora.article.19","other":{"work_id":"dora","level":"L1","locator":"dora/art/19","url":"/dora/articles/19","title":"Reporting of major ICT-related incidents and voluntary notification of significant cyber threats","key":"19","state_on_date":"in_force"},"evidence":{"object":"eu.dora.legal_text.article.11","source_block_id":"eu.dora.article.11.paragraph.2.point.e"}},{"edge_id":"a4bf95d0c66267bbfe89","scope":"unit","type":"refers_to","direction":"out","resolution":"resolved","basis":"explicit_legal_cross_reference","method":"extracted_relationships","confidence":"medium","src_from":"2022-12-27","src_until":null,"span":"Article 14","dst_raw":"eu.dora.article.14","other":{"work_id":"dora","level":"L1","locator":"dora/art/14","url":"/dora/articles/14","title":"Communication","key":"14","state_on_date":"in_force"},"evidence":{"object":"eu.dora.legal_text.article.11","source_block_id":"eu.dora.article.11.paragraph.2.point.e"}},{"edge_id":"8ef201d062302f84d867","scope":"unit","type":"uses_term","direction":"out","resolution":"resolved","basis":"curated_link_pass","method":"extracted_relationships","confidence":"high","src_from":"2022-12-27","src_until":null,"span":"ICT-related incident","dst_raw":"eu.dora.definition.ict-related-incident","other":{"work_id":"dora","level":"L1","locator":"dora/art/3/para/8","url":"/definitions/dora/ict-related-incident","title":"Definitions","key":"3(8)","state_on_date":"in_force"},"evidence":{"object":"eu.dora.legal_text.article.11","source_block_id":"eu.dora.article.11.paragraph.2.point.c"}},{"edge_id":"c11653f27cf083e488f6","scope":"unit","type":"refers_to","direction":"out","resolution":"resolved","basis":"explicit_legal_cross_reference","method":"extracted_relationships","confidence":"medium","src_from":"2022-12-27","src_until":null,"span":"Article 12","dst_raw":"eu.dora.article.12","other":{"work_id":"dora","level":"L1","locator":"dora/art/12","url":"/dora/articles/12","title":"Backup policies and procedures, restoration and recovery procedures and methods","key":"12","state_on_date":"in_force"},"evidence":{"object":"eu.dora.legal_text.article.11","source_block_id":"eu.dora.article.11.paragraph.2.point.c"}},{"edge_id":"d37bb8119388a248339f","scope":"unit","type":"uses_term","direction":"out","resolution":"resolved","basis":"curated_link_pass","method":"extracted_relationships","confidence":"high","src_from":"2022-12-27","src_until":null,"span":"critical or important functions","dst_raw":"eu.dora.definition.critical-or-important-function","other":{"work_id":"dora","level":"L1","locator":"dora/art/3/para/22","url":"/definitions/dora/critical-or-important-function","title":"Definitions","key":"3(22)","state_on_date":"in_force"},"evidence":{"object":"eu.dora.legal_text.article.11","source_block_id":"eu.dora.article.11.paragraph.6.point.a"}},{"edge_id":"ec20e76aa3883bb5ca2c","scope":"unit","type":"refers_to","direction":"out","resolution":"resolved","basis":"explicit_legal_cross_reference","method":"extracted_relationships","confidence":"medium","src_from":"2022-12-27","src_until":null,"span":"Article 14","dst_raw":"eu.dora.article.14","other":{"work_id":"dora","level":"L1","locator":"dora/art/14","url":"/dora/articles/14","title":"Communication","key":"14","state_on_date":"in_force"},"evidence":{"object":"eu.dora.legal_text.article.11","source_block_id":"eu.dora.article.11.paragraph.6.point.b"}},{"edge_id":"82710be0d3e866d74bde","scope":"unit","type":"uses_term","direction":"out","resolution":"resolved","basis":"curated_link_pass","method":"extracted_relationships","confidence":"high","src_from":"2022-12-27","src_until":null,"span":"ICT risk","dst_raw":"eu.dora.definition.ict-risk","other":{"work_id":"dora","level":"L1","locator":"dora/art/3/para/5","url":"/definitions/dora/ict-risk","title":"Definitions","key":"3(5)","state_on_date":"in_force"},"evidence":{"object":"eu.dora.legal_text.article.11","source_block_id":"eu.dora.article.11.paragraph.6"}},{"edge_id":"af0a485329e292b0eb33","scope":"unit","type":"refers_to","direction":"out","resolution":"resolved","basis":"explicit_legal_cross_reference","method":"extracted_relationships","confidence":"medium","src_from":"2022-12-27","src_until":null,"span":"Article 12","dst_raw":"eu.dora.article.12","other":{"work_id":"dora","level":"L1","locator":"dora/art/12","url":"/dora/articles/12","title":"Backup policies and procedures, restoration and recovery procedures and methods","key":"12","state_on_date":"in_force"},"evidence":{"object":"eu.dora.legal_text.article.11","source_block_id":"eu.dora.article.11.paragraph.6"}},{"edge_id":"17c21185f3082d653f75","scope":"unit","type":"uses_term","direction":"out","resolution":"resolved","basis":"curated_link_pass","method":"extracted_relationships","confidence":"high","src_from":"2022-12-27","src_until":null,"span":"information assets","dst_raw":"eu.dora.definition.information-asset","other":{"work_id":"dora","level":"L1","locator":"dora/art/3/para/6","url":"/definitions/dora/information-asset","title":"Definitions","key":"3(6)","state_on_date":"in_force"},"evidence":{"object":"eu.dora.legal_text.article.11","source_block_id":"eu.dora.article.11.paragraph.5"}},{"edge_id":"44e7b992d4c58b9a773c","scope":"unit","type":"uses_term","direction":"out","resolution":"resolved","basis":"curated_link_pass","method":"extracted_relationships","confidence":"high","src_from":"2022-12-27","src_until":null,"span":"ICT services","dst_raw":"eu.dora.definition.ict-services","other":{"work_id":"dora","level":"L1","locator":"dora/art/3/para/21","url":"/definitions/dora/ict-services","title":"Definitions","key":"3(21)","state_on_date":"in_force"},"evidence":{"object":"eu.dora.legal_text.article.11","source_block_id":"eu.dora.article.11.paragraph.5"}},{"edge_id":"f39da5748932e246a3db","scope":"unit","type":"uses_term","direction":"out","resolution":"resolved","basis":"curated_link_pass","method":"extracted_relationships","confidence":"high","src_from":"2022-12-27","src_until":null,"span":"ICT assets","dst_raw":"eu.dora.definition.ict-asset","other":{"work_id":"dora","level":"L1","locator":"dora/art/3/para/7","url":"/definitions/dora/ict-asset","title":"Definitions","key":"3(7)","state_on_date":"in_force"},"evidence":{"object":"eu.dora.legal_text.article.11","source_block_id":"eu.dora.article.11.paragraph.5"}},{"edge_id":"879384cef95b97adb0c7","scope":"unit","type":"refers_to","direction":"out","resolution":"resolved","basis":"explicit_legal_cross_reference","method":"extracted_relationships","confidence":"medium","src_from":"2022-12-27","src_until":null,"span":"Article 14","dst_raw":"eu.dora.article.14","other":{"work_id":"dora","level":"L1","locator":"dora/art/14","url":"/dora/articles/14","title":"Communication","key":"14","state_on_date":"in_force"},"evidence":{"object":"eu.dora.legal_text.article.11","source_block_id":"eu.dora.article.11.paragraph.7"}},{"edge_id":"c9750e7d5356b7c8480c","scope":"unit","type":"uses_term","direction":"out","resolution":"resolved","basis":"curated_link_pass","method":"extracted_relationships","confidence":"high","src_from":"2022-12-27","src_until":null,"span":"microenterprises","dst_raw":"eu.dora.definition.microenterprise","other":{"work_id":"dora","level":"L1","locator":"dora/art/3/para/60","url":"/definitions/dora/microenterprise","title":"Definitions","key":"3(60)","state_on_date":"in_force"},"evidence":{"object":"eu.dora.legal_text.article.11","source_block_id":"eu.dora.article.11.paragraph.7"}},{"edge_id":"0fc1b0022bf4f2b63cbc","scope":"unit","type":"uses_term","direction":"out","resolution":"resolved","basis":"curated_link_pass","method":"extracted_relationships","confidence":"high","src_from":"2022-12-27","src_until":null,"span":"ICT third-party service providers","dst_raw":"eu.dora.definition.ict-third-party-service-provider","other":{"work_id":"dora","level":"L1","locator":"dora/art/3/para/19","url":"/definitions/dora/ict-third-party-service-provider","title":"Definitions","key":"3(19)","state_on_date":"in_force"},"evidence":{"object":"eu.dora.legal_text.article.11","source_block_id":"eu.dora.article.11.paragraph.4"}},{"edge_id":"3e832a8381a45a4b8097","scope":"unit","type":"uses_term","direction":"out","resolution":"resolved","basis":"curated_link_pass","method":"extracted_relationships","confidence":"high","src_from":"2022-12-27","src_until":null,"span":"critical or important functions","dst_raw":"eu.dora.definition.critical-or-important-function","other":{"work_id":"dora","level":"L1","locator":"dora/art/3/para/22","url":"/definitions/dora/critical-or-important-function","title":"Definitions","key":"3(22)","state_on_date":"in_force"},"evidence":{"object":"eu.dora.legal_text.article.11","source_block_id":"eu.dora.article.11.paragraph.4"}},{"edge_id":"6312ee96b558bdb2c423","scope":"unit","type":"uses_term","direction":"out","resolution":"resolved","basis":"curated_link_pass","method":"extracted_relationships","confidence":"high","src_from":"2022-12-27","src_until":null,"span":"ICT-related incidents","dst_raw":"eu.dora.definition.ict-related-incident","other":{"work_id":"dora","level":"L1","locator":"dora/art/3/para/8","url":"/definitions/dora/ict-related-incident","title":"Definitions","key":"3(8)","state_on_date":"in_force"},"evidence":{"object":"eu.dora.legal_text.article.11","source_block_id":"eu.dora.article.11.paragraph.2.point.b"}},{"edge_id":"635656bc0f1da1712478","scope":"unit","type":"uses_term","direction":"out","resolution":"resolved","basis":"curated_link_pass","method":"extracted_relationships","confidence":"high","src_from":"2022-12-27","src_until":null,"span":"ICT risk","dst_raw":"eu.dora.definition.ict-risk","other":{"work_id":"dora","level":"L1","locator":"dora/art/3/para/5","url":"/definitions/dora/ict-risk","title":"Definitions","key":"3(5)","state_on_date":"in_force"},"evidence":{"object":"eu.dora.legal_text.article.11","source_block_id":"eu.dora.article.11.paragraph.1"}},{"edge_id":"80e93b054ac9cd098a9b","scope":"unit","type":"refers_to","direction":"out","resolution":"resolved","basis":"explicit_legal_cross_reference","method":"extracted_relationships","confidence":"medium","src_from":"2022-12-27","src_until":null,"span":"Article 6(1)","dst_raw":"eu.dora.article.6","other":{"work_id":"dora","level":"L1","locator":"dora/art/6","url":"/dora/articles/6","title":"ICT risk management framework","key":"6","state_on_date":"in_force"},"evidence":{"object":"eu.dora.legal_text.article.11","source_block_id":"eu.dora.article.11.paragraph.1"}},{"edge_id":"c49c35763d70a5a9a068","scope":"unit","type":"refers_to","direction":"out","resolution":"resolved","basis":"explicit_legal_cross_reference","method":"extracted_relationships","confidence":"medium","src_from":"2022-12-27","src_until":null,"span":"Article 8","dst_raw":"eu.dora.article.8","other":{"work_id":"dora","level":"L1","locator":"dora/art/8","url":"/dora/articles/8","title":"Identification","key":"8","state_on_date":"in_force"},"evidence":{"object":"eu.dora.legal_text.article.11","source_block_id":"eu.dora.article.11.paragraph.1"}},{"edge_id":"04e48b2e93ad399d0b75","scope":"unit","type":"uses_term","direction":"out","resolution":"resolved","basis":"curated_link_pass","method":"extracted_relationships","confidence":"high","src_from":"2022-12-27","src_until":null,"span":"Joint Committee","dst_raw":"eu.dora.definition.joint-committee","other":{"work_id":"dora","level":"L1","locator":"dora/art/3/para/62","url":"/definitions/dora/joint-committee","title":"Definitions","key":"3(62)","state_on_date":"in_force"},"evidence":{"object":"eu.dora.legal_text.article.11","source_block_id":"eu.dora.article.11.paragraph.11"}},{"edge_id":"85982abeaa7a844394e5","scope":"unit","type":"refers_to","direction":"out","resolution":"resolved","basis":"explicit_legal_cross_reference","method":"extracted_relationships","confidence":"medium","src_from":"2022-12-27","src_until":null,"span":"Article 16","dst_raw":"eu.dora.article.16","other":{"work_id":"dora","level":"L1","locator":"dora/art/16","url":"/dora/articles/16","title":"Simplified ICT risk management framework","key":"16","state_on_date":"in_force"},"evidence":{"object":"eu.dora.legal_text.article.11","source_block_id":"eu.dora.article.11.paragraph.11"}},{"edge_id":"966df51e2c66bfaf63f4","scope":"unit","type":"uses_term","direction":"out","resolution":"resolved","basis":"curated_link_pass","method":"extracted_relationships","confidence":"high","src_from":"2022-12-27","src_until":null,"span":"microenterprises","dst_raw":"eu.dora.definition.microenterprise","other":{"work_id":"dora","level":"L1","locator":"dora/art/3/para/60","url":"/definitions/dora/microenterprise","title":"Definitions","key":"3(60)","state_on_date":"in_force"},"evidence":{"object":"eu.dora.legal_text.article.11","source_block_id":"eu.dora.article.11.paragraph.10"}},{"edge_id":"aafe8afa53a2109ded8a","scope":"unit","type":"uses_term","direction":"out","resolution":"resolved","basis":"curated_link_pass","method":"extracted_relationships","confidence":"high","src_from":"2022-12-27","src_until":null,"span":"major ICT-related incidents","dst_raw":"eu.dora.definition.major-ict-related-incident","other":{"work_id":"dora","level":"L1","locator":"dora/art/3/para/10","url":"/definitions/dora/major-ict-related-incident","title":"Definitions","key":"3(10)","state_on_date":"in_force"},"evidence":{"object":"eu.dora.legal_text.article.11","source_block_id":"eu.dora.article.11.paragraph.10"}},{"edge_id":"4c502f6066ae4544cfaf","scope":"unit","type":"uses_term","direction":"out","resolution":"resolved","basis":"curated_link_pass","method":"extracted_relationships","confidence":"high","src_from":"2022-12-27","src_until":null,"span":"critical or important functions","dst_raw":"eu.dora.definition.critical-or-important-function","other":{"work_id":"dora","level":"L1","locator":"dora/art/3/para/22","url":"/definitions/dora/critical-or-important-function","title":"Definitions","key":"3(22)","state_on_date":"in_force"},"evidence":{"object":"eu.dora.legal_text.article.11","source_block_id":"eu.dora.article.11.paragraph.2.point.a"}},{"edge_id":"09a9379b654b69feb656","scope":"unit","type":"uses_term","direction":"out","resolution":"resolved","basis":"curated_link_pass","method":"extracted_relationships","confidence":"high","src_from":"2022-12-27","src_until":null,"span":"Central securities depositories","dst_raw":"eu.dora.definition.central-securities-depository","other":{"work_id":"dora","level":"L1","locator":"dora/art/3/para/42","url":"/definitions/dora/central-securities-depository","title":"Definitions","key":"3(42)","state_on_date":"in_force"},"evidence":{"object":"eu.dora.legal_text.article.11","source_block_id":"eu.dora.article.11.paragraph.9"}},{"edge_id":"7ef4d0fef95f90f364d3","scope":"unit","type":"uses_term","direction":"out","resolution":"resolved","basis":"curated_link_pass","method":"extracted_relationships","confidence":"high","src_from":"2022-12-27","src_until":null,"span":"microenterprises","dst_raw":"eu.dora.definition.microenterprise","other":{"work_id":"dora","level":"L1","locator":"dora/art/3/para/60","url":"/definitions/dora/microenterprise","title":"Definitions","key":"3(60)","state_on_date":"in_force"},"evidence":{"object":"eu.dora.legal_text.article.11","source_block_id":"eu.dora.article.11.paragraph.3"}},{"edge_id":"94718f72bc25a5bd4f85","scope":"unit","type":"uses_term","direction":"out","resolution":"resolved","basis":"curated_link_pass","method":"extracted_relationships","confidence":"high","src_from":"2022-12-27","src_until":null,"span":"ICT risk","dst_raw":"eu.dora.definition.ict-risk","other":{"work_id":"dora","level":"L1","locator":"dora/art/3/para/5","url":"/definitions/dora/ict-risk","title":"Definitions","key":"3(5)","state_on_date":"in_force"},"evidence":{"object":"eu.dora.legal_text.article.11","source_block_id":"eu.dora.article.11.paragraph.3"}},{"edge_id":"cc7e2392100ecef1e02d","scope":"unit","type":"refers_to","direction":"out","resolution":"resolved","basis":"explicit_legal_cross_reference","method":"extracted_relationships","confidence":"medium","src_from":"2022-12-27","src_until":null,"span":"Article 6(1)","dst_raw":"eu.dora.article.6","other":{"work_id":"dora","level":"L1","locator":"dora/art/6","url":"/dora/articles/6","title":"ICT risk management framework","key":"6","state_on_date":"in_force"},"evidence":{"object":"eu.dora.legal_text.article.11","source_block_id":"eu.dora.article.11.paragraph.3"}},{"edge_id":"6844c03a57d70073eb15","scope":"unit","type":"refers_to","direction":"in","resolution":"resolved","basis":"explicit_legal_cross_reference","method":"extracted_relationships","confidence":"medium","src_from":"2022-12-27","src_until":null,"span":"Article 11(3)","dst_raw":"eu.dora.article.11","other":{"work_id":"dora","level":"L1","locator":"dora/art/15","url":"/dora/articles/15","title":"Further harmonisation of ICT risk management tools, methods, processes and policies","key":"15","state_on_date":"in_force"},"evidence":{"object":"eu.dora.legal_text.article.15","source_block_id":"eu.dora.article.15"}},{"edge_id":"75694010f694aff04865","scope":"unit","type":"refers_to","direction":"in","resolution":"resolved","basis":"explicit_legal_cross_reference","method":"extracted_relationships","confidence":"medium","src_from":"2022-12-27","src_until":null,"span":"Article 11","dst_raw":"eu.dora.article.11","other":{"work_id":"dora","level":"L1","locator":"dora/art/13/para/2","url":"/dora/articles/13#p-2","title":"Learning and evolving","key":"13(2)","state_on_date":"in_force"},"evidence":{"object":"eu.dora.legal_text.article.13","source_block_id":"eu.dora.article.13.paragraph.2"}},{"edge_id":"a514e242c497d9d69afb","scope":"unit","type":"refers_to","direction":"in","resolution":"resolved","basis":"explicit_legal_cross_reference","method":"extracted_relationships","confidence":"medium","src_from":"2022-12-27","src_until":null,"span":"Article 11(1)","dst_raw":"eu.dora.article.11","other":{"work_id":"dora","level":"L1","locator":"dora/art/5/para/2/pt/e","url":"/dora/articles/5#p-2-e","title":"Governance and organisation","key":"5(2)(e)","state_on_date":"in_force"},"evidence":{"object":"eu.dora.legal_text.article.5","source_block_id":"eu.dora.article.5.paragraph.2.point.e"}},{"edge_id":"bc06669975c8de6daf25","scope":"unit","type":"refers_to","direction":"in","resolution":"resolved","basis":"explicit_legal_cross_reference","method":"extracted_relationships","confidence":"medium","src_from":"2022-12-27","src_until":null,"span":"Article 11(1)","dst_raw":"eu.dora.article.11","other":{"work_id":"dora","level":"L1","locator":"dora/art/15","url":"/dora/articles/15","title":"Further harmonisation of ICT risk management tools, methods, processes and policies","key":"15","state_on_date":"in_force"},"evidence":{"object":"eu.dora.legal_text.article.15","source_block_id":"eu.dora.article.15"}},{"edge_id":"fa24e7b7d52963da5ce9","scope":"unit","type":"refers_to","direction":"in","resolution":"resolved","basis":"explicit_legal_cross_reference","method":"extracted_relationships","confidence":"medium","src_from":"2022-12-27","src_until":null,"span":"Article 11(6)","dst_raw":"eu.dora.article.11","other":{"work_id":"dora","level":"L1","locator":"dora/art/15","url":"/dora/articles/15","title":"Further harmonisation of ICT risk management tools, methods, processes and policies","key":"15","state_on_date":"in_force"},"evidence":{"object":"eu.dora.legal_text.article.15","source_block_id":"eu.dora.article.15"}},{"edge_id":"cff162492e5c7e396a0e","scope":"unit","type":"guides","direction":"in","resolution":"resolved","basis":"curated_mapping","method":"stated_legal_basis","confidence":"curated","src_from":"2024-06-05","src_until":null,"span":null,"dst_raw":"eu.dora.article.11","other":{"work_id":"spaces/dora/level-3/guidelines/jc-gl-2024-34-costs-losses","level":"L3","locator":"spaces/dora/level-3/guidelines/jc-gl-2024-34-costs-losses/page","url":"/dora/level-3/guidelines/jc-gl-2024-34-costs-losses","title":"Guideline — Estimation of aggregated annual costs and losses [final]","key":"JC/GL/2024/34","state_on_date":"in_force"},"evidence":{"evidence":"legal_basis: Article 11(11) DORA","doc_type":"guideline"}}],"not_served":["exempts","derogates_from"],"note":"inverse edges are computed from the stored direction; floating targets are resolved on as_of (other.state_on_date)"}