Digital Operational Resilience Act

Framework for digital operational resilience for EU financial entities.

Jurisdiction: EU / EEA
Issuer: European Parliament and Council
Effective: 2025-01-17

Sectors

Banking & Finance Crypto & Digital Assets Digital Infrastructure ICT Service Management Insurance IT & Cybersecurity

Articles (137)

Article 20 — Harmonisation of reporting content and templatesEU_DORA Article 21 — Centralisation of reporting of major ICT-related incidentsEU_DORA Article 22 — Supervisory feedbackEU_DORA Article 23 — Operational or security payment-related incidents concerning credit institutions, payment institutions, account information service providers, and electronic money institutionsEU_DORA Article 24 — General requirements for the performance of digital operational resilience testingEU_DORA Article 25 — Testing of ICT tools and systemsEU_DORA Article 26 — Advanced testing of ICT tools, systems and processes based on TLPTEU_DORA Article 27 — Requirements for testers for the carrying out of TLPTEU_DORA Article 28 — General principlesEU_DORA Article 29 — Preliminary assessment of ICT concentration risk at entity levelEU_DORA Article 30 — Key contractual provisionsEU_DORA Article 31 — Designation of critical ICT third-party service providersEU_DORA Article 32 — Structure of the Oversight FrameworkEU_DORA Article 33 — Tasks of the Lead OverseerEU_DORA Article 34 — Operational coordination between Lead OverseersEU_DORA Article 35 — Powers of the Lead OverseerEU_DORA Article 36 — Exercise of the powers of the Lead Overseer outside the UnionEU_DORA Article 37 — Request for informationEU_DORA Article 38 — General investigationsEU_DORA Article 39 — InspectionsEU_DORA Article 40 — Ongoing oversightEU_DORA Article 41 — Harmonisation of conditions enabling the conduct of the oversight activitiesEU_DORA Article 42 — Follow-up by competent authoritiesEU_DORA Article 43 — Oversight feesEU_DORA Article 44 — International cooperationEU_DORA Article 45 — Information-sharing arrangements on cyber threat information and intelligenceEU_DORA Article 46 — Competent authoritiesEU_DORA Article 47 — Cooperation with structures and authorities established by Directive (EU) 2022/2555EU_DORA Article 48 — Cooperation between authoritiesEU_DORA Article 49 — Financial cross-sector exercises, communication and cooperationEU_DORA Article 50 — Administrative penalties and remedial measuresEU_DORA Article 51 — Exercise of the power to impose administrative penalties and remedial measuresEU_DORA Article 52 — Criminal penaltiesEU_DORA Article 53 — Notification dutiesEU_DORA Article 54 — Publication of administrative penaltiesEU_DORA Article 55 — Professional secrecyEU_DORA Article 56 — Data ProtectionEU_DORA Article 57 — Exercise of the delegationEU_DORA Article 58 — Review clauseEU_DORA Article 59 — Amendments to Regulation (EC) No 1060/2009EU_DORA Article 60 — Amendments to Regulation (EU) No 648/2012EU_DORA Article 61 — Amendments to Regulation (EU) No 909/2014EU_DORA Article 62 — Amendments to Regulation (EU) No 600/2014EU_DORA Article 63 — Amendment to Regulation (EU) 2016/1011EU_DORA Article 64 — Entry into force and applicationEU_DORA Article 1 — Subject matterEU_DORA Article 2 — ScopeEU_DORA Article 3 — DefinitionsEU_DORA Article 4 — Proportionality principleEU_DORA Article 5 — Governance and organisationEU_DORA Article 6 — ICT risk management frameworkEU_DORA Article 7 — ICT systems, protocols and toolsEU_DORA Article 8 — IdentificationEU_DORA Article 9 — Protection and preventionEU_DORA Article 10 — DetectionEU_DORA Article 11 — Response and recoveryEU_DORA Article 12 — Backup policies and procedures, restoration and recovery procedures and methodsEU_DORA Article 13 — Learning and evolvingEU_DORA Article 14 — CommunicationEU_DORA Article 15 — Further harmonisation of ICT risk management tools, methods, processes and policiesEU_DORA Article 16 — Simplified ICT risk management frameworkEU_DORA Article 17 — ICT-related incident management processEU_DORA Article 18 — Classification of ICT-related incidents and cyber threatsEU_DORA Article 19 — Reporting of major ICT-related incidents and voluntary notification of significant cyber threatsEU_DORA Article 1 — DefinitionsEU_DORA_ITS_2956 Article 2 — Ranking of ICT third-party providers in the supply chainEU_DORA_ITS_2956 Article 3 — General requirements for the templates of the register of informationEU_DORA_ITS_2956 Article 4 — Data format requirementEU_DORA_ITS_2956 Article 5 — Content of the register of informationEU_DORA_ITS_2956 Article 6 — Scope of the register of information at sub-consolidated and consolidated levelEU_DORA_ITS_2956 Article 7 — Entry into forceEU_DORA_ITS_2956 Article 1 — Clients, financial counterparts and transactionsEU_DORA_RTS_1772 Article 2 — Reputational impactEU_DORA_RTS_1772 Article 3 — Duration and service downtimeEU_DORA_RTS_1772 Article 4 — Geographical spreadEU_DORA_RTS_1772 Article 5 — Data lossesEU_DORA_RTS_1772 Article 6 — Criticality of services affectedEU_DORA_RTS_1772 Article 7 — Economic impactEU_DORA_RTS_1772 Article 8 — Major incidentsEU_DORA_RTS_1772 Article 9 — Materiality thresholds for determining major incidentsEU_DORA_RTS_1772 Article 10 — High materiality thresholds for determining significant cyber threatsEU_DORA_RTS_1772 Article 11 — Relevance of major incidents to competent authorities in other Member StatesEU_DORA_RTS_1772 Article 12 — Details of major incidents to be shared with other competent authoritiesEU_DORA_RTS_1772 Article 13 — Entry into forceEU_DORA_RTS_1772 Article 1 — Overall risk profile and complexityEU_DORA_RTS_1773 Article 2 — Group applicationEU_DORA_RTS_1773 Article 3 — Governance arrangementsEU_DORA_RTS_1773 Article 4 — Main phases of the life cycle for the adoption and use of contractual arrangementsEU_DORA_RTS_1773 Article 5 — Ex-ante risk assessmentEU_DORA_RTS_1773 Article 6 — Due diligenceEU_DORA_RTS_1773 Article 7 — Conflicts of interestEU_DORA_RTS_1773 Article 8 — Contractual clausesEU_DORA_RTS_1773 Article 9 — Monitoring of the contractual arrangementsEU_DORA_RTS_1773 Article 10 — Exit from and termination of the contractual arrangementsEU_DORA_RTS_1773 Article 11 — Entry into forceEU_DORA_RTS_1773 Article 1 — Overall risk profile and complexityEU_DORA_RTS_1774 Article 2 — General elements of ICT security policies, procedures, protocols, and toolsEU_DORA_RTS_1774 Article 3 — ICT risk managementEU_DORA_RTS_1774 Article 4 — ICT asset management policyEU_DORA_RTS_1774 Article 5 — ICT asset management procedureEU_DORA_RTS_1774 Article 6 — Encryption and cryptographic controlsEU_DORA_RTS_1774 Article 7 — Cryptographic key managementEU_DORA_RTS_1774 Article 8 — Policies and procedures for ICT operationsEU_DORA_RTS_1774 Article 9 — Capacity and performance managementEU_DORA_RTS_1774 Article 10 — Vulnerability and patch managementEU_DORA_RTS_1774 Article 11 — Data and system securityEU_DORA_RTS_1774 Article 12 — LoggingEU_DORA_RTS_1774 Article 13 — Network security managementEU_DORA_RTS_1774 Article 14 — Securing information in transitEU_DORA_RTS_1774 Article 15 — ICT project managementEU_DORA_RTS_1774 Article 16 — ICT systems acquisition, development, and maintenanceEU_DORA_RTS_1774 Article 17 — ICT change managementEU_DORA_RTS_1774 Article 18 — Physical and environmental securityEU_DORA_RTS_1774 Article 19 — Human resources policyEU_DORA_RTS_1774 Article 20 — Identity managementEU_DORA_RTS_1774 Article 21 — Access controlEU_DORA_RTS_1774 Article 22 — ICT-related incident management policyEU_DORA_RTS_1774 Article 23 — Anomalous activities detection and criteria for ICT-related incidents detection and responseEU_DORA_RTS_1774 Article 24 — Components of the ICT business continuity policyEU_DORA_RTS_1774 Article 25 — Testing of the ICT business continuity plansEU_DORA_RTS_1774 Article 26 — ICT response and recovery plansEU_DORA_RTS_1774 Article 27 — Format and content of the report on the review of the ICT risk management frameworkEU_DORA_RTS_1774 Article 28 — Governance and organisationEU_DORA_RTS_1774 Article 29 — Information security policy and measuresEU_DORA_RTS_1774 Article 30 — Classification of information assets and ICT assetsEU_DORA_RTS_1774 Article 31 — ICT risk managementEU_DORA_RTS_1774 Article 32 — Physical and environmental securityEU_DORA_RTS_1774 Article 33 — Access ControlEU_DORA_RTS_1774 Article 34 — ICT operations securityEU_DORA_RTS_1774 Article 35 — Data, system and network securityEU_DORA_RTS_1774 Article 36 — ICT security testingEU_DORA_RTS_1774 Article 37 — ICT systems acquisition, development, and maintenanceEU_DORA_RTS_1774 Article 38 — ICT project and change managementEU_DORA_RTS_1774 Article 39 — Components of the ICT business continuity planEU_DORA_RTS_1774 Article 40 — Testing of business continuity plansEU_DORA_RTS_1774 Article 41 — Format and content of the report on the review of the simplified ICT risk management frameworkEU_DORA_RTS_1774 Article 42 — Entry into forceEU_DORA_RTS_1774

Controls that address this (40)

DORA-A17-001-B - DORA Incident Classification and Managementoperational · critical priority · Implement DORA-aligned incident classification using Article 18 criteria. Establish 24/7 incident capability. Log all incidents. Conduct pos DORA-A5-001-B - Board ICT Risk Accountabilitygovernance · critical priority · Management body must formally approve ICT risk management framework, define ICT risk tolerance, and receive quarterly ICT risk reporting. Co DORA-GOV-001 - Maintain Board-Approved ICT Risk Management Frameworkoperational · critical priority · The management body must formally approve, own and oversee a documented ICT risk management framework. It must cover identification, protect