DORA

DORA Basics

Name: eurocompliant.com AI Compliance Copilot
Price: 299 EUR
Author: eurocompliant.com

The Digital Operational Resilience Act: ICT risk management, incident reporting, and third-party oversight for EU financial entities.

10 questions · 70% to pass · free

eurocompliant.com is not an accredited certification body. This is a self-paced educational assessment; the certificate confirms completion only, not a professional, statutory, or accredited qualification.

Your details

Name *

Email *

We'll email your certificate here if you pass. We may occasionally follow up about eurocompliant.com - you can unsubscribe any time.

Question 1 of 10

What does DORA stand for?

Digital Organisational Risk AssessmentData Oversight and Regulatory AuthorityDistributed Operational Resilience AgreementDigital Operational Resilience Act

Question 2 of 10

Which sector does DORA primarily regulate?

Healthcare providersEU financial entities (e.g. banks, insurers, investment firms) and their critical ICT third-party providersRetail supermarketsManufacturing companies

Question 3 of 10

Under Article 5, what must financial entities implement to manage ICT risk?

An internal governance and control framework, including an ICT risk management frameworkNothing formal — informal practices are sufficientOnly a basic antivirus programA single annual memo from IT

Question 4 of 10

Under Article 9, what is a core component of the ICT risk management framework?

Tools and systems to identify, protect, detect, respond to, and recover from ICT-related risksIgnoring risk until an incident occursOutsourcing all IT decisions with no oversightA ban on all cloud computing

Question 5 of 10

What does Article 17 require regarding ICT-related incident management?

No formal process is requiredDeleting all logs immediately after an incidentA process to monitor, log, and classify ICT-related incidentsReporting incidents only to competitors

Question 6 of 10

Under Article 18, what must financial entities do in the immediate aftermath of a major ICT-related incident?

Respond and recover, including activating dedicated response plansTransfer all customer data to a third partyShut down permanentlyNothing until the next annual report

Question 7 of 10

What is the general purpose of Article 23's incident classification criteria?

To set marketing budgetsTo determine executive bonusesTo determine which ICT-related incidents qualify as 'major' and trigger regulatory reporting obligationsTo rank employees by performance

Question 8 of 10

Under Article 28, what must financial entities do before entering into a contractual arrangement with an ICT third-party service provider?

Nothing — no due diligence is requiredAssess ICT concentration risk and the provider's ability to meet applicable requirements, among other thingsWait for the provider to request an assessmentSimply choose the cheapest provider available

Question 9 of 10

What does Article 38 require regarding digital operational resilience testing?

Only external auditors may ever test systemsA proportionate testing programme covering ICT tools and systems, appropriate to the entity's size and risk profileTesting only needs to happen once, at company formationTesting is entirely optional

Question 10 of 10

What is a 'critical ICT third-party service provider' under DORA's oversight framework?

Any vendor at all, regardless of significanceA provider designated as critical based on criteria such as systemic impact, subject to direct oversight by European Supervisory AuthoritiesA term with no formal meaning under DORAOnly providers based outside the EU

0 of 10 answered