Skip to the text
headlesslaw
Search or jump to a citation
/
Definitions
DORA · contents
Recitals
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
Chapter I — General provisions
1
Subject matter
2
Scope
3
Definitions
4
Proportionality principle
Chapter II — ICT risk management
Section I
5
Governance and organisation
Section II
6
ICT risk management framework
7
ICT systems, protocols and tools
8
Identification
9
Protection and prevention
10
Detection
11
Response and recovery
12
Backup policies and procedures, restoration and recovery procedures and methods
13
Learning and evolving
14
Communication
15
Further harmonisation of ICT risk management tools, methods, processes and policies
16
Simplified ICT risk management framework
Chapter III — ICT-related incident management, classification and reporting
17
ICT-related incident management process
18
Classification of ICT-related incidents and cyber threats
19
Reporting of major ICT-related incidents and voluntary notification of significant cyber threats
20
Harmonisation of reporting content and templates
21
Centralisation of reporting of major ICT-related incidents
22
Supervisory feedback
23
Operational or security payment-related incidents concerning credit institutions, payment institutions, account information service providers, and electronic money institutions
Chapter IV — Digital operational resilience testing
24
General requirements for the performance of digital operational resilience testing
25
Testing of ICT tools and systems
26
Advanced testing of ICT tools, systems and processes based on TLPT
27
Requirements for testers for the carrying out of TLPT
Chapter V — Managing of ICT third-party risk
Section I — Key principles for a sound management of ICT third-party risk
28
General principles
29
Preliminary assessment of ICT concentration risk at entity level
30
Key contractual provisions
Section II — Oversight Framework of critical ICT third-party service providers
31
Designation of critical ICT third-party service providers
32
Structure of the Oversight Framework
33
Tasks of the Lead Overseer
34
Operational coordination between Lead Overseers
35
Powers of the Lead Overseer
36
Exercise of the powers of the Lead Overseer outside the Union
37
Request for information
38
General investigations
39
Inspections
40
Ongoing oversight
41
Harmonisation of conditions enabling the conduct of the oversight activities
42
Follow-up by competent authorities
43
Oversight fees
44
International cooperation
Chapter VI — Information-sharing arrangements
45
Information-sharing arrangements on cyber threat information and intelligence
Chapter VII — Competent authorities
46
Competent authorities
47
Cooperation with structures and authorities established by Directive (EU) 2022/2555
48
Cooperation between authorities
49
Financial cross-sector exercises, communication and cooperation
50
Administrative penalties and remedial measures
51
Exercise of the power to impose administrative penalties and remedial measures
52
Criminal penalties
53
Notification duties
54
Publication of administrative penalties
55
Professional secrecy
56
Data Protection
Chapter VIII — Delegated acts
57
Exercise of the delegation
Chapter IX — Transitional and final provisions
Section I
58
Review clause
Section II — Amendments
59
Amendments to Regulation (EC) No 1060/2009
60
Amendments to Regulation (EU) No 648/2012
61
Amendments to Regulation (EU) No 909/2014
62
Amendments to Regulation (EU) No 600/2014
63
Amendment to Regulation (EU) 2016/1011
64
Entry into force and application
Reports and advice
Financial services
Level 3
DORA
Reports and advice under DORA, ordered by official identifier.
ESA/2023/23
Advice — CTPP designation criteria and oversight fees
Technical advice
Published
JC/2025/29
Report — Guide on oversight activities for critical ICT providers
Report
Published
JC/2025/85
Report — Article 58(3) review: statutory auditors and audit firms
Report
Published