DORA

This Regulation lays down requirements for the digital operational resilience of financial entities and their critical ICT third-party service providers.

Key definitions including ICT risk, ICT service, digital operational resilience, and incident.

Financial entities shall have in place an effective and sound ICT risk management framework.

Financial entities shall use and maintain updated ICT systems, protocols and tools that are reliable, have sufficient capacity, and are technologically resilient.

Financial entities shall have in place mechanisms to promptly detect anomalous activities, including ICT-related incidents.

Financial entities shall put in place a comprehensive ICT business continuity policy and ICT response and recovery plans.

Financial entities shall put in place an ICT-related incident management process to detect, manage and notify ICT-related incidents.

Financial entities shall manage ICT third-party risk as an integral element of their ICT risk management framework.

Financial entities shall adopt a strategy on ICT third-party risk and exercise due diligence when assessing ICT third-party service providers.

Financial entities shall assess the potential impact of ICT concentration risk on the continuous delivery of critical or important functions.

Financial entities shall report major ICT-related incidents and significant cyber threats to the competent authorities.

Financial entities shall establish, maintain and review a digital operational resilience testing programme.

Financial entities identified by competent authorities shall carry out threat-led penetration testing on their critical or important functions at least every three years.