Legal text
DORA
Regulation (EU) 2022/2554 — Digital Operational Resilience Act
Article
- DORA Article 1Subject matter
- DORA Article 2Scope
- DORA Article 3Definitions
- DORA Article 4Proportionality principle
- DORA Article 5Governance and organisation
- DORA Article 6ICT risk management framework
- DORA Article 7ICT systems, protocols and tools
- DORA Article 8Identification
- DORA Article 9Protection and prevention
- DORA Article 10Detection
- DORA Article 11Response and recovery
- DORA Article 12Backup policies and procedures, restoration and recovery procedures and methods
- DORA Article 13Learning and evolving
- DORA Article 14Communication
- DORA Article 15Further harmonisation of ICT risk management tools, methods, processes and policies
- DORA Article 16Simplified ICT risk management framework
- DORA Article 17ICT-related incident management process
- DORA Article 18Classification of ICT-related incidents and cyber threats
- DORA Article 19Reporting of major ICT-related incidents and voluntary notification of significant cyber threats
- DORA Article 20Harmonisation of reporting content and templates
- DORA Article 21Centralisation of reporting of major ICT-related incidents
- DORA Article 22Supervisory feedback
- DORA Article 23Operational or security payment-related incidents concerning credit institutions, payment institutions, account information service providers, and electronic money institutions
- DORA Article 24General requirements for the performance of digital operational resilience testing
- DORA Article 25Testing of ICT tools and systems
- DORA Article 26Advanced testing of ICT tools, systems and processes based on TLPT
- DORA Article 27Requirements for testers for the carrying out of TLPT
- DORA Article 28General principles
- DORA Article 29Preliminary assessment of ICT concentration risk at entity level
- DORA Article 30Key contractual provisions
- DORA Article 31Designation of critical ICT third-party service providers
- DORA Article 32Structure of the Oversight Framework
- DORA Article 33Tasks of the Lead Overseer
- DORA Article 34Operational coordination between Lead Overseers
- DORA Article 35Powers of the Lead Overseer
- DORA Article 36Exercise of the powers of the Lead Overseer outside the Union
- DORA Article 37Request for information
- DORA Article 38General investigations
- DORA Article 39Inspections
- DORA Article 40Ongoing oversight
- DORA Article 41Harmonisation of conditions enabling the conduct of the oversight activities
- DORA Article 42Follow-up by competent authorities
- DORA Article 43Oversight fees
- DORA Article 44International cooperation
- DORA Article 45Information-sharing arrangements on cyber threat information and intelligence
- DORA Article 46Competent authorities
- DORA Article 47Cooperation with structures and authorities established by Directive (EU) 2022/2555
- DORA Article 48Cooperation between authorities
- DORA Article 49Financial cross-sector exercises, communication and cooperation
- DORA Article 50Administrative penalties and remedial measures
- DORA Article 51Exercise of the power to impose administrative penalties and remedial measures
- DORA Article 52Criminal penalties
- DORA Article 53Notification duties
- DORA Article 54Publication of administrative penalties
- DORA Article 55Professional secrecy
- DORA Article 56Data Protection
- DORA Article 57Exercise of the delegation
- DORA Article 58Review clause
- DORA Article 59Amendments to Regulation (EC) No 1060/2009
- DORA Article 60Amendments to Regulation (EU) No 648/2012
- DORA Article 61Amendments to Regulation (EU) No 909/2014
- DORA Article 62Amendments to Regulation (EU) No 600/2014
- DORA Article 63Amendment to Regulation (EU) 2016/1011
- DORA Article 64Entry into force and application
Recital
- DORA recital 1
- DORA recital 2
- DORA recital 3
- DORA recital 4
- DORA recital 5
- DORA recital 6
- DORA recital 7
- DORA recital 8
- DORA recital 9
- DORA recital 10
- DORA recital 11
- DORA recital 12
- DORA recital 13
- DORA recital 14
- DORA recital 15
- DORA recital 16
- DORA recital 17
- DORA recital 18
- DORA recital 19
- DORA recital 20
- DORA recital 21
- DORA recital 22
- DORA recital 23
- DORA recital 24
- DORA recital 25
- DORA recital 26
- DORA recital 27
- DORA recital 28
- DORA recital 29
- DORA recital 30
- DORA recital 31
- DORA recital 32
- DORA recital 33
- DORA recital 34
- DORA recital 35
- DORA recital 36
- DORA recital 37
- DORA recital 38
- DORA recital 39
- DORA recital 40
- DORA recital 41
- DORA recital 42
- DORA recital 43
- DORA recital 44
- DORA recital 45
- DORA recital 46
- DORA recital 47
- DORA recital 48
- DORA recital 49
- DORA recital 50
- DORA recital 51
- DORA recital 52
- DORA recital 53
- DORA recital 54
- DORA recital 55
- DORA recital 56
- DORA recital 57
- DORA recital 58
- DORA recital 59
- DORA recital 60
- DORA recital 61
- DORA recital 62
- DORA recital 63
- DORA recital 64
- DORA recital 65
- DORA recital 66
- DORA recital 67
- DORA recital 68
- DORA recital 69
- DORA recital 70
- DORA recital 71
- DORA recital 72
- DORA recital 73
- DORA recital 74
- DORA recital 75
- DORA recital 76
- DORA recital 77
- DORA recital 78
- DORA recital 79
- DORA recital 80
- DORA recital 81
- DORA recital 82
- DORA recital 83
- DORA recital 84
- DORA recital 85
- DORA recital 86
- DORA recital 87
- DORA recital 88
- DORA recital 89
- DORA recital 90
- DORA recital 91
- DORA recital 92
- DORA recital 93
- DORA recital 94
- DORA recital 95
- DORA recital 96
- DORA recital 97
- DORA recital 98
- DORA recital 99
- DORA recital 100
- DORA recital 101
- DORA recital 102
- DORA recital 103
- DORA recital 104
- DORA recital 105
- DORA recital 106
Definition
- ‘digital operational resilience’digital operational resilience
- ‘network and information system’network and information system
- ‘legacy ICT system’legacy ICT system
- ‘security of network and information systems’security of network and information systems
- ‘ICT risk’ICT risk
- ‘information asset’information asset
- ‘ICT asset’ICT asset
- ‘ICT-related incident’ICT-related incident
- ‘operational or security payment-related incident’operational or security payment-related incident
- ‘major ICT-related incident’major ICT-related incident
- ‘major operational or security payment-related incident’major operational or security payment-related incident
- ‘cyber threat’cyber threat
- ‘significant cyber threat’significant cyber threat
- ‘cyber-attack’cyber-attack
- ‘threat intelligence’threat intelligence
- ‘vulnerability’vulnerability
- ‘threat-led penetration testing (TLPT)’threat-led penetration testing (TLPT)
- ‘ICT third-party risk’ICT third-party risk
- ‘ICT third-party service provider’ICT third-party service provider
- ‘ICT intra-group service provider’ICT intra-group service provider
- ‘ICT services’ICT services
- ‘critical or important function’critical or important function
- ‘critical ICT third-party service provider’critical ICT third-party service provider
- ‘ICT third-party service provider established in a third country’ICT third-party service provider established in a third country
- ‘subsidiary’subsidiary
- ‘group’group
- ‘parent undertaking’parent undertaking
- ‘ICT subcontractor established in a third country’ICT subcontractor established in a third country
- ‘ICT concentration risk’ICT concentration risk
- ‘management body’management body
- ‘credit institution’credit institution
- ‘institution exempted pursuant to Directive 2013/36/EU’institution exempted pursuant to Directive 2013/36/EU
- ‘investment firm’investment firm
- ‘small and non-interconnected investment firm’small and non-interconnected investment firm
- ‘payment institution’payment institution
- ‘payment institution exempted pursuant to Directive (EU) 2015/2366’payment institution exempted pursuant to Directive (EU) 2015/2366
- ‘account information service provider’account information service provider
- ‘electronic money institution’electronic money institution
- ‘electronic money institution exempted pursuant to Directive 2009/110/EC’electronic money institution exempted pursuant to Directive 2009/110/EC
- ‘central counterparty’central counterparty
- ‘trade repository’trade repository
- ‘central securities depository’central securities depository
- ‘trading venue’trading venue
- ‘manager of alternative investment funds’manager of alternative investment funds
- ‘management company’management company
- ‘data reporting service provider’data reporting service provider
- ‘insurance undertaking’insurance undertaking
- ‘reinsurance undertaking’reinsurance undertaking
- ‘insurance intermediary’insurance intermediary
- ‘ancillary insurance intermediary’ancillary insurance intermediary
- ‘reinsurance intermediary’reinsurance intermediary
- ‘institution for occupational retirement provision’institution for occupational retirement provision
- ‘small institution for occupational retirement provision’small institution for occupational retirement provision
- ‘credit rating agency’credit rating agency
- ‘crypto-asset service provider’crypto-asset service provider
- ‘issuer of asset-referenced tokens’issuer of asset-referenced tokens
- ‘administrator of critical benchmarks’administrator of critical benchmarks
- ‘crowdfunding service provider’crowdfunding service provider
- ‘securitisation repository’securitisation repository
- ‘microenterprise’microenterprise
- ‘Lead Overseer’Lead Overseer
- ‘Joint Committee’Joint Committee
- ‘small enterprise’small enterprise
- ‘medium-sized enterprise’medium-sized enterprise
- ‘public authority’public authority