# Digital Operational Resilience Act (DORA) – Regulation (EU) 2022/2554 URL: https://consilena.com/coverage/laws/stat_eu_32022r2554 - Jurisdiction: European Union - Type: Regulation - Short name: DORA - Identifier: 32022R2554 - Provisions: 64 - Official text: https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:32022R2554 - Licence: [Commission Decision 2011/833/EU](https://eur-lex.europa.eu/eli/dec/2011/833/oj) - Attribution: Source: EUR-Lex, © European Union, https://eur-lex.europa.eu. Reuse authorised under Commission Decision 2011/833/EU; only the Official Journal text is authentic. > The library is a research copy. Check the official source before relying on a provision: the text published there, not the copy in Consilena, is the law. ## Provisions ### Chapter I – General provisions - **Art. 1 Subject matter**: 1. In order to achieve a high common level of digital operational resilience, this Regulation lays down uniform requirements concerning the security of network… - **Art. 2 Scope**: 1. Without prejudice to paragraphs 3 and 4, this Regulation applies to the following entities: (a) credit institutions; (b) payment institutions, including… - **Art. 3 Definitions**: For the purposes of this Regulation, the following definitions shall apply: (1) ‘digital operational resilience’ means the ability of a financial entity to… - **Art. 4 Proportionality principle**: 1. Financial entities shall implement the rules laid down in Chapter II in accordance with the principle of proportionality, taking into account their size and… ### Chapter II – ICT risk management - **Art. 5 Governance and organisation**: 1. Financial entities shall have in place an internal governance and control framework that ensures an effective and prudent management of ICT risk, in… - **Art. 6 ICT risk management framework**: 1. Financial entities shall have a sound, comprehensive and well-documented ICT risk management framework as part of their overall risk management system… - **Art. 7 ICT systems, protocols and tools**: In order to address and manage ICT risk, financial entities shall use and maintain updated ICT systems, protocols and tools that are: (a) appropriate to the… - **Art. 8 Identification**: 1. As part of the ICT risk management framework referred to in Article 6(1), financial entities shall identify, classify and adequately document all ICT… - **Art. 9 Protection and prevention**: 1. For the purposes of adequately protecting ICT systems and with a view to organising response measures, financial entities shall continuously monitor and… - **Art. 10 Detection**: 1. Financial entities shall have in place mechanisms to promptly detect anomalous activities, in accordance with Article 17, including ICT network performance… - **Art. 11 Response and recovery**: 1. As part of the ICT risk management framework referred to in Article 6(1) and based on the identification requirements set out in Article 8, financial… - **Art. 12 Backup policies and procedures, restoration and recovery procedures and methods**: 1. For the purpose of ensuring the restoration of ICT systems and data with minimum downtime, limited disruption and loss, as part of their ICT risk management… - **Art. 13 Learning and evolving**: 1. Financial entities shall have in place capabilities and staff to gather information on vulnerabilities and cyber threats, ICT-related incidents, in… - **Art. 14 Communication**: 1. As part of the ICT risk management framework referred to in Article 6(1), financial entities shall have in place crisis communication plans enabling a… - **Art. 15 Further harmonisation of ICT risk management tools, methods, processes and policies**: The ESAs shall, through the Joint Committee, in consultation with the European Union Agency on Cybersecurity (ENISA), develop common draft regulatory technical… - **Art. 16 Simplified ICT risk management framework**: 1. Articles 5 to 15 of this Regulation shall not apply to small and non-interconnected investment firms, payment institutions exempted pursuant to Directive… ### Chapter III – ICT-related incident management, classification and reporting - **Art. 17 ICT-related incident management process**: 1. Financial entities shall define, establish and implement an ICT-related incident management process to detect, manage and notify ICT-related incidents. 2… - **Art. 18 Classification of ICT-related incidents and cyber threats**: 1. Financial entities shall classify ICT-related incidents and shall determine their impact based on the following criteria: (a) the number and/or relevance of… - **Art. 19 Reporting of major ICT-related incidents and voluntary notification of significant cyber threats**: 1. Financial entities shall report major ICT-related incidents to the relevant competent authority as referred to in Article 46 in accordance with paragraph 4… - **Art. 20 Harmonisation of reporting content and templates**: The ESAs, through the Joint Committee, and in consultation with ENISA and the ECB, shall develop: (a) common draft regulatory technical standards in order to… - **Art. 21 Centralisation of reporting of major ICT-related incidents**: 1. The ESAs, through the Joint Committee, and in consultation with the ECB and ENISA, shall prepare a joint report assessing the feasibility of further… - **Art. 22 Supervisory feedback**: 1. Without prejudice to the technical input, advice or remedies and subsequent follow-up which may be provided, where applicable, in accordance with national… - **Art. 23 Operational or security payment-related incidents concerning credit institutions, payment institutions, account information service providers, and electronic money institutions**: The requirements laid down in this Chapter shall also apply to operational or security payment-related incidents and to major operational or security… ### Chapter IV – Digital operational resilience testing - **Art. 24 General requirements for the performance of digital operational resilience testing**: 1. For the purpose of assessing preparedness for handling ICT-related incidents, of identifying weaknesses, deficiencies and gaps in digital operational… - **Art. 25 Testing of ICT tools and systems**: 1. The digital operational resilience testing programme referred to in Article 24 shall provide, in accordance with the criteria set out in Article 4(2), for… - **Art. 26 Advanced testing of ICT tools, systems and processes based on TLPT**: 1. Financial entities, other than entities referred to in Article 16(1), first subparagraph, and other than microenterprises, which are identified in… - **Art. 27 Requirements for testers for the carrying out of TLPT**: 1. Financial entities shall only use testers for the carrying out of TLPT, that: (a) are of the highest suitability and reputability; (b) possess technical and… ### Chapter V – Managing of ICT third-party risk - **Art. 28 General principles**: 1. Financial entities shall manage ICT third-party risk as an integral component of ICT risk within their ICT risk management framework as referred to in… - **Art. 29 Preliminary assessment of ICT concentration risk at entity level**: 1. When performing the identification and assessment of risks referred to in Article 28(4), point (c), financial entities shall also take into account whether… - **Art. 30 Key contractual provisions**: 1. The rights and obligations of the financial entity and of the ICT third-party service provider shall be clearly allocated and set out in writing. The full… - **Art. 31 Designation of critical ICT third-party service providers**: 1. The ESAs, through the Joint Committee and upon recommendation from the Oversight Forum established pursuant to Article 32(1), shall: (a) designate the ICT… - **Art. 32 Structure of the Oversight Framework**: 1. The Joint Committee, in accordance with Article 57(1) of Regulations (EU) No 1093/2010, (EU) No 1094/2010 and (EU) No 1095/2010, shall establish the… - **Art. 33 Tasks of the Lead Overseer**: 1. The Lead Overseer, appointed in accordance with Article 31(1), point (b), shall conduct the oversight of the assigned critical ICT third-party service… - **Art. 34 Operational coordination between Lead Overseers**: 1. To ensure a consistent approach to oversight activities and with a view to enabling coordinated general oversight strategies and cohesive operational… - **Art. 35 Powers of the Lead Overseer**: 1. For the purposes of carrying out the duties laid down in this Section, the Lead Overseer shall have the following powers in respect of the critical ICT… - **Art. 36 Exercise of the powers of the Lead Overseer outside the Union**: 1. When oversight objectives cannot be attained by means of interacting with the subsidiary set up for the purpose of Article 31(12), or by exercising… - **Art. 37 Request for information**: 1. The Lead Overseer may, by simple request or by decision, require critical ICT third-party service providers to provide all information that is necessary for… - **Art. 38 General investigations**: 1. In order to carry out its duties under this Regulation, the Lead Overseer, assisted by the joint examination team referred to in Article 40(1), may, where… - **Art. 39 Inspections**: 1. In order to carry out its duties under this Regulation, the Lead Overseer, assisted by the joint examination teams referred to in Article 40(1), may enter… - **Art. 40 Ongoing oversight**: 1. When conducting oversight activities, in particular general investigations or inspections, the Lead Overseer shall be assisted by a joint examination team… - **Art. 41 Harmonisation of conditions enabling the conduct of the oversight activities**: 1. The ESAs shall, through the Joint Committee, develop draft regulatory technical standards to specify: (a) the information to be provided by an ICT… - **Art. 42 Follow-up by competent authorities**: 1. Within 60 calendar days of the receipt of the recommendations issued by the Lead Overseer pursuant to Article 35(1), point (d), critical ICT third-party… - **Art. 43 Oversight fees**: 1. The Lead Overseer shall, in accordance with the delegated act referred to in paragraph 2 of this Article, charge critical ICT third-party service providers… - **Art. 44 International cooperation**: 1. Without prejudice to Article 36, EBA, ESMA and EIOPA may, in accordance with Article 33 of Regulations (EU) No 1093/2010, (EU) No 1095/2010 and (EU) No… ### Chapter VI – Information-sharing arrangements - **Art. 45 Information-sharing arrangements on cyber threat information and intelligence**: 1. Financial entities may exchange amongst themselves cyber threat information and intelligence, including indicators of compromise, tactics, techniques, and… ### Chapter VII – Competent authorities - **Art. 46 Competent authorities**: — Art. 46 — Competent authorities Without prejudice to the provisions on the Oversight Framework for critical ICT third-party service providers referred to in… - **Art. 47 Cooperation with structures and authorities established by Directive (EU) 2022/2555**: 1. To foster cooperation and enable supervisory exchanges between the competent authorities designated under this Regulation and the Cooperation Group… - **Art. 48 Cooperation between authorities**: 1. Competent authorities shall cooperate closely among themselves and, where applicable, with the Lead Overseer. 2. Competent authorities and the Lead Overseer… - **Art. 49 Financial cross-sector exercises, communication and cooperation**: 1. The ESAs, through the Joint Committee and in collaboration with competent authorities, resolution authorities as referred to in Article 3 of Directive… - **Art. 50 Administrative penalties and remedial measures**: 1. Competent authorities shall have all supervisory, investigatory and sanctioning powers necessary to fulfil their duties under this Regulation. 2. The powers… - **Art. 51 Exercise of the power to impose administrative penalties and remedial measures**: 1. Competent authorities shall exercise the powers to impose administrative penalties and remedial measures referred to in Article 50 in accordance with their… - **Art. 52 Criminal penalties**: 1. Member States may decide not to lay down rules for administrative penalties or remedial measures for breaches that are subject to criminal penalties under… - **Art. 53 Notification duties**: Member States shall notify the laws, regulations and administrative provisions implementing this Chapter, including any relevant criminal law provisions, to… - **Art. 54 Publication of administrative penalties**: 1. Competent authorities shall publish on their official websites, without undue delay, any decision imposing an administrative penalty against which there is… - **Art. 55 Professional secrecy**: 1. Any confidential information received, exchanged or transmitted pursuant to this Regulation shall be subject to the conditions of professional secrecy laid… - **Art. 56 Data Protection**: 1. The ESAs and the competent authorities shall be allowed to process personal data only where necessary for the purpose of carrying out their respective… ### Chapter VIII – Delegated acts - **Art. 57 Exercise of the delegation**: 1. The power to adopt delegated acts is conferred on the Commission subject to the conditions laid down in this Article. 2. The power to adopt delegated acts… ### Chapter IX – Transitional and final provisions - **Art. 58 Review clause**: 1. By 17 January 2028, the Commission shall, after consulting the ESAs and the ESRB, as appropriate, carry out a review and submit a report to the European… - **Art. 59 Amendments to Regulation (EC) No 1060/2009**: Regulation (EC) No 1060/2009 is amended as follows: (1) in Annex I, Section A, point 4, the first subparagraph is replaced by the following: ‘A credit rating… - **Art. 60 Amendments to Regulation (EU) No 648/2012**: Regulation (EU) No 648/2012 is amended as follows: (1) Article 26 is amended as follows: (a) paragraph 3 is replaced by the following: ‘3. A CCP shall maintain… - **Art. 61 Amendments to Regulation (EU) No 909/2014**: Article 45 of Regulation (EU) No 909/2014 is amended as follows: (1) paragraph 1 is replaced by the following: ‘1. A CSD shall identify sources of operational… - **Art. 62 Amendments to Regulation (EU) No 600/2014**: Regulation (EU) No 600/2014 is amended as follows: (1) Article 27g is amended as follows: (a) paragraph 4 is replaced by the following: ‘4. An APA shall comply… - **Art. 63 Amendment to Regulation (EU) 2016/1011**: In Article 6 of Regulation (EU) 2016/1011, the following paragraph is added: ‘6. For critical benchmarks, an administrator shall have sound administrative and… - **Art. 64 Entry into force and application**: This Regulation shall enter into force on the twentieth day following that of its publication in the Official Journal of the European Union. It shall apply… --- Consilena is a software provider, not a law firm. AI output is not legal advice: consult a licensed lawyer in the relevant jurisdiction. Page: https://consilena.com/coverage/laws/stat_eu_32022r2554. Index of every page: https://consilena.com/llms.txt.