IBITGQ C-DORA flashcards

32 cards. Read the term and the definition here. The deck at the top of this page is optional.

DORA Regulation number

Regulation (EU) 2022/2554 on digital operational resilience for the financial sector, applicable from 17 January 2025.

DORA five pillars

ICT risk management, incident management, resilience testing, ICT third-party risk, and information-sharing arrangements.

Proportionality principle

DORA obligations scale to entity size, risk profile, and complexity, with a simplified framework for small non-interconnected entities under Article 16.

Management body responsibility

The management body defines and approves the ICT risk tolerance and digital resilience strategy and remains accountable for DORA compliance.

Microenterprise testing exemption

Microenterprises are exempt from the digital operational resilience testing requirement under Article 25 but must still meet other DORA obligations.

Critical ICT third-party provider

A provider designated by ESAs as critical due to systemic importance, subject to EU oversight even without an EU establishment.

ICT risk framework review

The ICT risk management framework must be reviewed at least annually and after material incidents or supervisory instructions.

Asset identification

Article 9 requires identifying all ICT-supported business functions, information assets, and dependencies, and mapping them to systems.

Single point of failure

An ICT dependency whose failure would disrupt critical functions; Article 8 requires identifying and mitigating such points.

Backup requirements

Backups must be kept separate from primary infrastructure, encrypted, and restoration must be periodically tested under Article 12.

Business continuity testing

Article 11 requires a business continuity policy with RTO and RPO targets and tested recovery plans for critical functions.

Detection mechanisms

Article 10 requires systems and processes to detect anomalous activities promptly and to log and monitor ICT events.

Post-incident review

Article 13 requires lessons learned after incidents to feed back into the ICT risk framework and controls.

Independent ICT risk function

The ICT risk management function must be independent, adequately staffed, and report directly to the management body.

Initial notification deadline

The initial incident notification must be submitted within 4 hours of classification and no later than 24 hours from detection.

Intermediate report deadline

The intermediate incident report must be submitted within 72 hours of the initial notification under DORA Article 19.

Final report deadline

The final incident report must be submitted within one month of the initial notification, covering root cause and remediation.

Major incident classification

Classification considers clients affected, reputational impact, duration and downtime, geographical spread, data losses, and service criticality.

Threat-led penetration testing

TLPT under Article 26 must be performed at least every three years for significant entities, following the TIBER-EU methodology.

TLPT scope

TLPT covers critical live production systems; testers must be independent and authorised, and testing must not disrupt operations.

Testing programme

Article 24 requires an annual digital operational resilience testing programme proportionate to size, risk profile, and complexity.

Voluntary threat reporting

Article 19(2) allows entities to voluntarily notify competent authorities of significant cyber threats not qualifying as incidents.

Register of information

Article 28 requires a register of all contractual arrangements with ICT third-party providers, maintained and updated.

Pre-contract due diligence

Before contracting, entities must assess the provider's ICT risk, security posture, subcontracting chain, and ability to meet obligations.

Mandatory contract clauses

Article 30 requires clauses on service levels, audit and access rights, data location, exit strategies, and termination rights.

Exit strategy

A documented and tested plan allowing the entity to migrate or terminate an ICT service without material disruption.

Concentration risk

The risk arising from dependence on a small number of ICT providers that are difficult to substitute or replace.

Critical or important function

A function whose disruption would materially impair financial performance, soundness, or continuity of services, triggering stricter obligations.

Subcontracting chain

Entities must assess and monitor subcontracting arrangements of ICT providers, ensuring visibility and equivalent contractual protections.

Audit and access rights

Contracts must grant the entity and supervisors audit, inspection, and access rights over the ICT provider and its subcontractors.

Third-party risk strategy

The management body approves the ICT third-party risk strategy, including oversight of the register and concentration risk.

CTPP designation criteria

ESAs designate critical providers based on systemic importance, substitutability, and number of financial entity clients served.