{"release":{"id":"2d86bd12ba77a288053b34ea2517324b92d03c8039b7f5d156fa4002421384a1","published":"2026-11-10T16:06:46Z","pinned":false},"limits":{"coverage":{"history":"full","held_since":"2022-12-27","gaps":[],"covered":["DORA L1"],"not_covered":["national guidance","court decisions"]},"freshness":{"release_id":"2d86bd12ba77a288053b34ea2517324b92d03c8039b7f5d156fa4002421384a1","release_published":"2026-11-10T16:06:46Z","checked_at":null,"checked_against":null},"truncation":{"shown":15,"total":15,"capped":false,"cap":1000,"next_cursor":null},"failures":[],"incomplete":[]},"page":{"path":"/dora/articles/15","url":"https://www.headlesslaw.com/dora/articles/15","title":"Article 15 — Further harmonisation of ICT risk management tools, methods, processes and policies","work_id":"dora","date_state":"current","as_of":"2026-11-11","relations_url":"https://www.headlesslaw.com/dora/articles/15/relations"},"as_of":"2026-11-11","counts":{"refers_to:out":8,"uses_term:out":4,"refers_to:in":2,"implements:in":1},"relations":[{"edge_id":"1ff77fa2e38446016ae2","scope":"unit","type":"refers_to","direction":"out","resolution":"resolved","basis":"explicit_legal_cross_reference","method":"extracted_relationships","confidence":"medium","src_from":"2022-12-27","src_until":null,"span":"Article 9(2)","dst_raw":"eu.dora.article.9","other":{"work_id":"dora","level":"L1","locator":"dora/art/9","url":"/dora/articles/9","title":"Protection and prevention","key":"9","state_on_date":"in_force"},"evidence":{"object":"eu.dora.legal_text.article.15","source_block_id":"eu.dora.article.15"}},{"edge_id":"35fb82f1df6dac437c6f","scope":"unit","type":"uses_term","direction":"out","resolution":"resolved","basis":"curated_link_pass","method":"extracted_relationships","confidence":"high","src_from":"2022-12-27","src_until":null,"span":"ICT risk","dst_raw":"eu.dora.definition.ict-risk","other":{"work_id":"dora","level":"L1","locator":"dora/art/3/para/5","url":"/definitions/dora/ict-risk","title":"Definitions","key":"3(5)","state_on_date":"in_force"},"evidence":{"object":"eu.dora.legal_text.article.15","source_block_id":"eu.dora.article.15"}},{"edge_id":"578de8b6a890ed54ef0d","scope":"unit","type":"refers_to","direction":"out","resolution":"resolved","basis":"explicit_legal_cross_reference","method":"extracted_relationships","confidence":"medium","src_from":"2022-12-27","src_until":null,"span":"Article 10(2)","dst_raw":"eu.dora.article.10","other":{"work_id":"dora","level":"L1","locator":"dora/art/10","url":"/dora/articles/10","title":"Detection","key":"10","state_on_date":"in_force"},"evidence":{"object":"eu.dora.legal_text.article.15","source_block_id":"eu.dora.article.15"}},{"edge_id":"57d3a713d2b60aa570bf","scope":"unit","type":"refers_to","direction":"out","resolution":"resolved","basis":"explicit_legal_cross_reference","method":"extracted_relationships","confidence":"medium","src_from":"2022-12-27","src_until":null,"span":"Article 6(5)","dst_raw":"eu.dora.article.6","other":{"work_id":"dora","level":"L1","locator":"dora/art/6","url":"/dora/articles/6","title":"ICT risk management framework","key":"6","state_on_date":"in_force"},"evidence":{"object":"eu.dora.legal_text.article.15","source_block_id":"eu.dora.article.15"}},{"edge_id":"6844c03a57d70073eb15","scope":"unit","type":"refers_to","direction":"out","resolution":"resolved","basis":"explicit_legal_cross_reference","method":"extracted_relationships","confidence":"medium","src_from":"2022-12-27","src_until":null,"span":"Article 11(3)","dst_raw":"eu.dora.article.11","other":{"work_id":"dora","level":"L1","locator":"dora/art/11","url":"/dora/articles/11","title":"Response and recovery","key":"11","state_on_date":"in_force"},"evidence":{"object":"eu.dora.legal_text.article.15","source_block_id":"eu.dora.article.15"}},{"edge_id":"bc06669975c8de6daf25","scope":"unit","type":"refers_to","direction":"out","resolution":"resolved","basis":"explicit_legal_cross_reference","method":"extracted_relationships","confidence":"medium","src_from":"2022-12-27","src_until":null,"span":"Article 11(1)","dst_raw":"eu.dora.article.11","other":{"work_id":"dora","level":"L1","locator":"dora/art/11","url":"/dora/articles/11","title":"Response and recovery","key":"11","state_on_date":"in_force"},"evidence":{"object":"eu.dora.legal_text.article.15","source_block_id":"eu.dora.article.15"}},{"edge_id":"c2ab277b4b186d04e6df","scope":"unit","type":"uses_term","direction":"out","resolution":"resolved","basis":"curated_link_pass","method":"extracted_relationships","confidence":"high","src_from":"2022-12-27","src_until":null,"span":"critical or important function","dst_raw":"eu.dora.definition.critical-or-important-function","other":{"work_id":"dora","level":"L1","locator":"dora/art/3/para/22","url":"/definitions/dora/critical-or-important-function","title":"Definitions","key":"3(22)","state_on_date":"in_force"},"evidence":{"object":"eu.dora.legal_text.article.15","source_block_id":"eu.dora.article.15"}},{"edge_id":"d878b8f4775d4d8e1a42","scope":"unit","type":"refers_to","direction":"out","resolution":"resolved","basis":"explicit_legal_cross_reference","method":"extracted_relationships","confidence":"medium","src_from":"2022-12-27","src_until":null,"span":"Article 10(1)","dst_raw":"eu.dora.article.10","other":{"work_id":"dora","level":"L1","locator":"dora/art/10","url":"/dora/articles/10","title":"Detection","key":"10","state_on_date":"in_force"},"evidence":{"object":"eu.dora.legal_text.article.15","source_block_id":"eu.dora.article.15"}},{"edge_id":"d8f0eb04375ad46eeb8a","scope":"unit","type":"uses_term","direction":"out","resolution":"resolved","basis":"curated_link_pass","method":"extracted_relationships","confidence":"high","src_from":"2022-12-27","src_until":null,"span":"ICT third-party service provider","dst_raw":"eu.dora.definition.ict-third-party-service-provider","other":{"work_id":"dora","level":"L1","locator":"dora/art/3/para/19","url":"/definitions/dora/ict-third-party-service-provider","title":"Definitions","key":"3(19)","state_on_date":"in_force"},"evidence":{"object":"eu.dora.legal_text.article.15","source_block_id":"eu.dora.article.15"}},{"edge_id":"dedc4396cbc6b03d7bcb","scope":"unit","type":"refers_to","direction":"out","resolution":"resolved","basis":"explicit_legal_cross_reference","method":"extracted_relationships","confidence":"medium","src_from":"2022-12-27","src_until":null,"span":"Article 9(4)","dst_raw":"eu.dora.article.9","other":{"work_id":"dora","level":"L1","locator":"dora/art/9","url":"/dora/articles/9","title":"Protection and prevention","key":"9","state_on_date":"in_force"},"evidence":{"object":"eu.dora.legal_text.article.15","source_block_id":"eu.dora.article.15"}},{"edge_id":"e6c44b33a9d7a00cd5de","scope":"unit","type":"uses_term","direction":"out","resolution":"resolved","basis":"curated_link_pass","method":"extracted_relationships","confidence":"high","src_from":"2022-12-27","src_until":null,"span":"ICT-related incident","dst_raw":"eu.dora.definition.ict-related-incident","other":{"work_id":"dora","level":"L1","locator":"dora/art/3/para/8","url":"/definitions/dora/ict-related-incident","title":"Definitions","key":"3(8)","state_on_date":"in_force"},"evidence":{"object":"eu.dora.legal_text.article.15","source_block_id":"eu.dora.article.15"}},{"edge_id":"fa24e7b7d52963da5ce9","scope":"unit","type":"refers_to","direction":"out","resolution":"resolved","basis":"explicit_legal_cross_reference","method":"extracted_relationships","confidence":"medium","src_from":"2022-12-27","src_until":null,"span":"Article 11(6)","dst_raw":"eu.dora.article.11","other":{"work_id":"dora","level":"L1","locator":"dora/art/11","url":"/dora/articles/11","title":"Response and recovery","key":"11","state_on_date":"in_force"},"evidence":{"object":"eu.dora.legal_text.article.15","source_block_id":"eu.dora.article.15"}},{"edge_id":"49161961727984ec3991","scope":"unit","type":"refers_to","direction":"in","resolution":"resolved","basis":"explicit_legal_cross_reference","method":"extracted_relationships","confidence":"medium","src_from":"2022-12-27","src_until":null,"span":"Article 15","dst_raw":"eu.dora.article.15","other":{"work_id":"dora","level":"L1","locator":"dora/art/28/para/9","url":"/dora/articles/28#p-9","title":"General principles","key":"28(9)","state_on_date":"in_force"},"evidence":{"object":"eu.dora.legal_text.article.28","source_block_id":"eu.dora.article.28.paragraph.9"}},{"edge_id":"9cb4efb285cf681458ad","scope":"unit","type":"refers_to","direction":"in","resolution":"resolved","basis":"explicit_legal_cross_reference","method":"extracted_relationships","confidence":"medium","src_from":"2022-12-27","src_until":null,"span":"Article 15","dst_raw":"eu.dora.article.15","other":{"work_id":"dora","level":"L1","locator":"dora/art/20","url":"/dora/articles/20","title":"Harmonisation of reporting content and templates","key":"20","state_on_date":"in_force"},"evidence":{"object":"eu.dora.legal_text.article.20","source_block_id":"eu.dora.article.20"}},{"edge_id":"e3d20e204fceb461b14c","scope":"unit","type":"implements","direction":"in","resolution":"resolved","basis":"curated_mapping","method":"stated_legal_basis","confidence":"curated","src_from":"2024-07-15","src_until":null,"span":null,"dst_raw":"eu.dora.article.15","other":{"work_id":"spaces/dora/level-2/rts/2024-1774-ict-risk-management-framework","level":"L2","locator":"spaces/dora/level-2/rts/2024-1774-ict-risk-management-framework/head","url":"/dora/level-2/rts/2024-1774-ict-risk-management-framework","title":"RTS — ICT Risk Framework [in force]","key":"2024/1774","state_on_date":"in_force"},"evidence":{"evidence":"legal_basis: Articles 15 and 16(3) DORA | CELLAR 32024R1774: A15L4 A16P3L4","doc_type":"rts"}}],"not_served":["exempts","derogates_from"],"note":"inverse edges are computed from the stored direction; floating targets are resolved on as_of (other.state_on_date)"}