Article 1 — Subject matter
Financial servicesLevel 1RegulationDORAApplies from 17 Jan 2025In force, but its rules apply only from the date shown.VerifiedIdentical to the official source.Official source
1(1)Copy link
1.In order to achieve a high common level of digital operational resilience, this Regulation lays down uniform requirements concerning the security of network and information systems supporting the business processes of financial entities as follows:
1(1)(a)(ii)
(ii)reporting of major ICT-related incidents and notifying, on a voluntary basis, significant cyber threats to the competent authorities;
Copy link1(1)(a)(iii)
(iii)reporting of major operational or security payment-related incidents to the competent authorities by financial entities referred to in Article 2(1), points (a) to (d);
Copy link1(1)(a)(v)
(v)information and intelligence sharing in relation to cyber threats and vulnerabilities;
Copy link1(1)(b)
(b)requirements in relation to the contractual arrangements concluded between ICT third-party service providers and financial entities;
Copy link1(1)(c)
(c)rules for the establishment and conduct of the Oversight Framework for critical ICT third-party service providers when providing services to financial entities;
Copy link1(1)(d)
(d)rules on cooperation among competent authorities, and rules on supervision and enforcement by competent authorities in relation to all matters covered by this Regulation.
Copy link