{"release":{"id":"2d86bd12ba77a288053b34ea2517324b92d03c8039b7f5d156fa4002421384a1","published":"2026-11-10T16:06:46Z","pinned":false},"limits":{"coverage":{"history":"full","held_since":"2022-12-27","gaps":[],"covered":["DORA L1"],"not_covered":["national guidance","court decisions"]},"freshness":{"release_id":"2d86bd12ba77a288053b34ea2517324b92d03c8039b7f5d156fa4002421384a1","release_published":"2026-11-10T16:06:46Z","checked_at":null,"checked_against":null},"truncation":{"shown":14,"total":14,"capped":false,"cap":1000,"next_cursor":null},"failures":[],"incomplete":[]},"page":{"path":"/dora/articles/9","url":"https://www.headlesslaw.com/dora/articles/9","title":"Article 9 — Protection and prevention","work_id":"dora","date_state":"past","as_of":"2023-01-16","relations_url":"https://www.headlesslaw.com/dora/articles/9/relations"},"as_of":"2023-01-16","counts":{"uses_term:out":10,"refers_to:out":2,"refers_to:in":2},"relations":[{"edge_id":"fc7623f66f2a0d4fe49a","scope":"unit","type":"uses_term","direction":"out","resolution":"resolved","basis":"curated_link_pass","method":"extracted_relationships","confidence":"high","src_from":"2022-12-27","src_until":null,"span":"ICT risk","dst_raw":"eu.dora.definition.ict-risk","other":{"work_id":"dora","level":"L1","locator":"dora/art/3/para/5","url":"/definitions/dora/ict-risk","title":"Definitions","key":"3(5)","state_on_date":"in_force"},"evidence":{"object":"eu.dora.legal_text.article.9","source_block_id":"eu.dora.article.9.paragraph.1"}},{"edge_id":"1f8dc5775eb4f41e9114","scope":"unit","type":"uses_term","direction":"out","resolution":"resolved","basis":"curated_link_pass","method":"extracted_relationships","confidence":"high","src_from":"2022-12-27","src_until":null,"span":"cyber-attacks","dst_raw":"eu.dora.definition.cyber-attack","other":{"work_id":"dora","level":"L1","locator":"dora/art/3/para/14","url":"/definitions/dora/cyber-attack","title":"Definitions","key":"3(14)","state_on_date":"in_force"},"evidence":{"object":"eu.dora.legal_text.article.9","source_block_id":"eu.dora.article.9.paragraph.4.point.b"}},{"edge_id":"8e29d4b10c76a25fc5e8","scope":"unit","type":"uses_term","direction":"out","resolution":"resolved","basis":"curated_link_pass","method":"extracted_relationships","confidence":"high","src_from":"2022-12-27","src_until":null,"span":"information assets","dst_raw":"eu.dora.definition.information-asset","other":{"work_id":"dora","level":"L1","locator":"dora/art/3/para/6","url":"/definitions/dora/information-asset","title":"Definitions","key":"3(6)","state_on_date":"in_force"},"evidence":{"object":"eu.dora.legal_text.article.9","source_block_id":"eu.dora.article.9.paragraph.4.point.b"}},{"edge_id":"7ada02117731ae3b0882","scope":"unit","type":"refers_to","direction":"out","resolution":"resolved","basis":"explicit_legal_cross_reference","method":"extracted_relationships","confidence":"medium","src_from":"2022-12-27","src_until":null,"span":"Article 6(1)","dst_raw":"eu.dora.article.6","other":{"work_id":"dora","level":"L1","locator":"dora/art/6","url":"/dora/articles/6","title":"ICT risk management framework","key":"6","state_on_date":"in_force"},"evidence":{"object":"eu.dora.legal_text.article.9","source_block_id":"eu.dora.article.9.paragraph.4"}},{"edge_id":"92bd8b130a39ad04e673","scope":"unit","type":"uses_term","direction":"out","resolution":"resolved","basis":"curated_link_pass","method":"extracted_relationships","confidence":"high","src_from":"2022-12-27","src_until":null,"span":"ICT risk","dst_raw":"eu.dora.definition.ict-risk","other":{"work_id":"dora","level":"L1","locator":"dora/art/3/para/5","url":"/definitions/dora/ict-risk","title":"Definitions","key":"3(5)","state_on_date":"in_force"},"evidence":{"object":"eu.dora.legal_text.article.9","source_block_id":"eu.dora.article.9.paragraph.4"}},{"edge_id":"53b5804caca1c7080941","scope":"unit","type":"uses_term","direction":"out","resolution":"resolved","basis":"curated_link_pass","method":"extracted_relationships","confidence":"high","src_from":"2022-12-27","src_until":null,"span":"ICT risk","dst_raw":"eu.dora.definition.ict-risk","other":{"work_id":"dora","level":"L1","locator":"dora/art/3/para/5","url":"/definitions/dora/ict-risk","title":"Definitions","key":"3(5)","state_on_date":"in_force"},"evidence":{"object":"eu.dora.legal_text.article.9","source_block_id":"eu.dora.article.9.paragraph.4.point.d"}},{"edge_id":"253c668e33e83a731d65","scope":"unit","type":"uses_term","direction":"out","resolution":"resolved","basis":"curated_link_pass","method":"extracted_relationships","confidence":"high","src_from":"2022-12-27","src_until":null,"span":"information assets","dst_raw":"eu.dora.definition.information-asset","other":{"work_id":"dora","level":"L1","locator":"dora/art/3/para/6","url":"/definitions/dora/information-asset","title":"Definitions","key":"3(6)","state_on_date":"in_force"},"evidence":{"object":"eu.dora.legal_text.article.9","source_block_id":"eu.dora.article.9.paragraph.4.point.c"}},{"edge_id":"408779270b4336c8ff6d","scope":"unit","type":"uses_term","direction":"out","resolution":"resolved","basis":"curated_link_pass","method":"extracted_relationships","confidence":"high","src_from":"2022-12-27","src_until":null,"span":"ICT assets","dst_raw":"eu.dora.definition.ict-asset","other":{"work_id":"dora","level":"L1","locator":"dora/art/3/para/7","url":"/definitions/dora/ict-asset","title":"Definitions","key":"3(7)","state_on_date":"in_force"},"evidence":{"object":"eu.dora.legal_text.article.9","source_block_id":"eu.dora.article.9.paragraph.4.point.c"}},{"edge_id":"660dfe9f783f760b322e","scope":"unit","type":"refers_to","direction":"out","resolution":"resolved","basis":"explicit_legal_cross_reference","method":"extracted_relationships","confidence":"medium","src_from":"2022-12-27","src_until":null,"span":"Article 4","dst_raw":"eu.dora.article.4","other":{"work_id":"dora","level":"L1","locator":"dora/art/4","url":"/dora/articles/4","title":"Proportionality principle","key":"4","state_on_date":"in_force"},"evidence":{"object":"eu.dora.legal_text.article.9","source_block_id":"eu.dora.article.9.paragraph.3"}},{"edge_id":"26253773da77c1b90f0f","scope":"unit","type":"uses_term","direction":"out","resolution":"resolved","basis":"curated_link_pass","method":"extracted_relationships","confidence":"high","src_from":"2022-12-27","src_until":null,"span":"information assets","dst_raw":"eu.dora.definition.information-asset","other":{"work_id":"dora","level":"L1","locator":"dora/art/3/para/6","url":"/definitions/dora/information-asset","title":"Definitions","key":"3(6)","state_on_date":"in_force"},"evidence":{"object":"eu.dora.legal_text.article.9","source_block_id":"eu.dora.article.9.paragraph.4.point.a"}},{"edge_id":"9260acb2d9359230c974","scope":"unit","type":"uses_term","direction":"out","resolution":"resolved","basis":"curated_link_pass","method":"extracted_relationships","confidence":"high","src_from":"2022-12-27","src_until":null,"span":"ICT assets","dst_raw":"eu.dora.definition.ict-asset","other":{"work_id":"dora","level":"L1","locator":"dora/art/3/para/7","url":"/definitions/dora/ict-asset","title":"Definitions","key":"3(7)","state_on_date":"in_force"},"evidence":{"object":"eu.dora.legal_text.article.9","source_block_id":"eu.dora.article.9.paragraph.4.point.a"}},{"edge_id":"814f070e15069297100f","scope":"unit","type":"uses_term","direction":"out","resolution":"resolved","basis":"curated_link_pass","method":"extracted_relationships","confidence":"high","src_from":"2022-12-27","src_until":null,"span":"critical or important functions","dst_raw":"eu.dora.definition.critical-or-important-function","other":{"work_id":"dora","level":"L1","locator":"dora/art/3/para/22","url":"/definitions/dora/critical-or-important-function","title":"Definitions","key":"3(22)","state_on_date":"in_force"},"evidence":{"object":"eu.dora.legal_text.article.9","source_block_id":"eu.dora.article.9.paragraph.2"}},{"edge_id":"1ff77fa2e38446016ae2","scope":"unit","type":"refers_to","direction":"in","resolution":"resolved","basis":"explicit_legal_cross_reference","method":"extracted_relationships","confidence":"medium","src_from":"2022-12-27","src_until":null,"span":"Article 9(2)","dst_raw":"eu.dora.article.9","other":{"work_id":"dora","level":"L1","locator":"dora/art/15","url":"/dora/articles/15","title":"Further harmonisation of ICT risk management tools, methods, processes and policies","key":"15","state_on_date":"in_force"},"evidence":{"object":"eu.dora.legal_text.article.15","source_block_id":"eu.dora.article.15"}},{"edge_id":"dedc4396cbc6b03d7bcb","scope":"unit","type":"refers_to","direction":"in","resolution":"resolved","basis":"explicit_legal_cross_reference","method":"extracted_relationships","confidence":"medium","src_from":"2022-12-27","src_until":null,"span":"Article 9(4)","dst_raw":"eu.dora.article.9","other":{"work_id":"dora","level":"L1","locator":"dora/art/15","url":"/dora/articles/15","title":"Further harmonisation of ICT risk management tools, methods, processes and policies","key":"15","state_on_date":"in_force"},"evidence":{"object":"eu.dora.legal_text.article.15","source_block_id":"eu.dora.article.15"}}],"not_served":["exempts","derogates_from"],"note":"inverse edges are computed from the stored direction; floating targets are resolved on as_of (other.state_on_date)"}