IBITGQ C-DORA cheat sheet

DORA = Regulation (EU) 2022/2554, applied from 17 January 2025; it is a regulation, so it binds directly without national transposition.

Scope covers 20+ financial entity types: credit institutions, payment institutions, investment firms, insurers, crypto-asset service providers, and ICT third-party providers serving them.

Five pillars: ICT risk management, ICT incident management, digital operational resilience testing, ICT third-party risk, and information-sharing arrangements.

Proportionality: simplified ICT risk framework applies to small and non-interconnected entities as defined in Article 16.

Microenterprises are exempt from the digital operational resilience testing requirement under Article 25 but not from other pillars.

Management body bears ultimate responsibility for ICT risk; it must define, approve, and oversee the ICT risk tolerance and the digital resilience strategy.

DORA prevails over conflicting sectoral ICT rules; ESAs may adopt regulatory technical standards (RTS) and implementing technical standards (ITS) to harmonise application.

Non-EU ICT providers designated critical (CTPP) fall under ESA oversight even without an EU establishment.

Article 6 requires an internal governance and control framework ensuring a sound and prudent management of all ICT risk, documented and reviewed at least annually.

The ICT risk management framework must be reviewed at least once a year, and after material incidents or supervisory instructions.

Article 9 mandates identification of all ICT-supported business functions, assets, and dependencies, and mapping of information assets.

Article 10 requires detection mechanisms and prompt anomaly identification; Article 11 requires business continuity policy with RTO/RPO targets and tested recovery plans.

Article 12 requires backup policies: backups kept separate from primary infrastructure, encrypted, and restoration tested periodically.

Article 13 mandates post-incident reviews and lessons-learned processes feeding back into the framework.

Article 8 requires identification of single points of failure and mitigation of concentration risk across ICT systems.

The ICT risk management function must be independent, staffed adequately, and report directly to the management body.

Three-stage reporting under DORA: initial notification within 4 hours of classification (max 24 hours from detection), intermediate report within 72 hours, final report within one month.

Classification criteria: incident must be major if it meets thresholds on clients/financial counterparts affected, reputational impact, duration and service downtime, geographical spread, data losses, and criticality of services.

Article 19 obliges reporting to the competent authority; Article 19(2) allows voluntary reporting of significant cyber threats.

Article 24 requires a digital operational resilience testing programme, at least annually, proportionate to size and risk profile.

Article 26 mandates threat-led penetration testing (TLPT) at least every three years for significant entities, based on TIBER-EU methodology.

TLPT scope includes critical live production systems; testers must be independent, external, or internally segregated with authority approval.

Article 23 requires testing procedures, risk controls, and remediation of findings; testing must not disrupt production.

Testing results and remediation plans must be documented and reported to the management body.

Article 28 requires a register of information on all contractual arrangements with ICT third-party providers, maintained and updated.

Pre-contract due diligence: assess provider's ICT risk, security posture, subcontracting chain, and ability to meet contractual obligations.

Mandatory contract clauses under Article 30 include service descriptions, SLAs, audit and access rights, exit strategies, data location, and termination rights.

Exit strategies must be documented and tested; the entity must be able to migrate or terminate without material disruption.

Concentration risk assessment required: identify providers that are difficult to substitute and dependencies across the group.

Critical or important functions (CIF) trigger stricter contractual and oversight obligations, including TLPT alignment and enhanced audit rights.

Article 31 designates critical ICT third-party providers (CTPPs) supervised by ESAs; designation can be based on systemic importance.

The management body approves the ICT third-party risk strategy and oversees the register and concentration risk.