IBITGQ C-DORA key terms

EU regulation (Regulation (EU) 2022/2554) that harmonises how financial entities manage ICT risk, report ICT incidents, test resilience and oversee ICT third-party providers, applying from 17 January 2025.

The ability of a financial entity to build, assure and review its operational integrity and reliability, by ensuring it can withstand all types of ICT-related disruptions and threats and continue delivering services.

Any entity type listed in DORA Article 2(1), such as credit institutions, payment institutions, investment firms, insurers, crypto-asset service providers and crowdfunding service providers, that must comply with the regulation.

The principle requiring financial entities to apply DORA requirements in a manner proportionate to their size, business and risk profile, and to the nature, scale and complexity of their services, rather than a one-size-fits-all approach.

Any reasonably identifiable circumstance or event related to the use of network and information systems that, if it occurs, may compromise the security of those systems or the data, processes or services they support.

The documented set of strategies, policies, procedures, tools and controls through which a financial entity identifies, protects against, detects, responds to, recovers from and learns from ICT risk, approved and reviewed by the management body.

A lighter set of requirements available to certain smaller or lower-risk financial entities, letting them meet core governance, protection, detection and recovery obligations without applying every element of the full framework.

The governing organ of a financial entity, which remains ultimately responsible for managing ICT risk, approving and overseeing the ICT risk strategy and framework, and allocating sufficient budget and resources.

The level of ICT risk a financial entity is willing to accept, expressed through quantitative or qualitative thresholds, aligned with its overall risk appetite and used to trigger escalation and remediation.

An approved set of arrangements covering backup, restoration and recovery of ICT systems and data, including crisis communication and periodic testing, so that critical services can be maintained or resumed within agreed objectives.

The maximum acceptable time within which a business process or ICT system must be restored after disruption, used to size recovery capability and to judge whether continuity arrangements remain adequate.

The maximum acceptable amount of data, measured in time, that may be lost in a disruption, driving backup frequency and replication design for systems supporting critical or important functions.

A structured assessment identifying business functions, their dependencies on ICT and the harm caused by their disruption, used to set recovery objectives and to classify functions as critical or important.

A function whose disruption would materially impair a financial entity's financial performance, soundness, or the continuity of its services and compliance, and which therefore attracts stricter resilience and outsourcing requirements.

A maintained record of hardware, software, data, network components and dependencies, including their owners and criticality, forming the basis for risk assessment, patching, testing and incident scoping.

The discipline of defining, recording and controlling the state of ICT assets and their settings, including baselines and change control, so that unauthorised or unmanaged changes do not undermine resilience.

A controlled process for identifying, prioritising, testing and deploying software updates that fix vulnerabilities, with documented timelines and exception handling for systems supporting critical or important functions.

A weakness in software, hardware, configuration or process that a threat could exploit; DORA requires systematic identification and remediation, with monitoring of publicly disclosed vulnerabilities for relevant ICT assets.

Any potential cause of an ICT-related incident, such as malicious actors, malware, social engineering or environmental hazards, whose likelihood and impact a financial entity must assess and monitor.

Information about current and emerging threats, tactics and indicators, gathered and analysed to inform detection, prevention and testing, and shared where relevant with peers and authorities.

A single or series of linked events compromising the availability, authenticity, integrity or confidentiality of data or ICT systems, or the security of related services, regardless of whether it was caused intentionally.

An ICT-related incident meeting DORA's classification criteria, such as significant impact on critical services, clients, transactions, duration, data loss or geographic spread, which triggers reporting to competent authorities.

The process of assessing an ICT-related incident against defined criteria, including clients and transactions affected, reputational impact, service downtime, geographic spread and data losses, to decide whether it is major and reportable.

The obligation to notify competent authorities of major ICT-related incidents using standard templates and timelines, covering initial notification, intermediate report and final report, and to inform affected clients where appropriate.

The documented workflow for detecting, logging, classifying, escalating, resolving and learning from ICT-related incidents, including roles, communication channels and root-cause analysis.

A risk-based, documented programme of ICT resilience tests, ranging from vulnerability assessments to scenario-based exercises, applied at least annually to systems supporting critical or important functions.

An advanced, intelligence-driven red-team exercise covering live production systems and critical functions, performed at least every three years by qualified testers, with findings shared and remediation tracked.

An undertaking providing ICT services to a financial entity, including cloud, data analytics, software and infrastructure providers, subject to contractual, due diligence and register obligations under DORA.

The risk that reliance on external ICT providers, including their subcontractors, undermines a financial entity's operational resilience, service continuity, data security or regulatory compliance.

A structured record of all contractual arrangements with ICT third-party service providers, including services, subcontracting chains and criticality, submitted to competent authorities and used for oversight.

An ICT provider designated by European supervisory authorities because of its systemic importance and the number of financial entities relying on it, bringing it under a dedicated EU oversight framework.

The risk arising from over-reliance on a small number of ICT providers or on closely interconnected providers, which can amplify the impact of a single failure across critical functions and the wider financial sector.

A documented plan for terminating an ICT service arrangement, including data migration, transition to another provider or in-house solution, and the resources and time needed, tested where feasible.

The written agreement with an ICT provider that must include DORA-mandated elements such as service descriptions, data location, audit and access rights, performance targets, termination rights and subcontracting conditions.

Contractual entitlements allowing a financial entity, its auditors and competent authorities to inspect, access and obtain information from an ICT provider, supporting oversight of outsourced critical functions.

The succession of providers and subcontractors involved in delivering an ICT service; financial entities must understand and monitor it because dependencies and concentration may extend beyond the direct provider.

A document explaining how a financial entity implements its ICT risk management framework, including risk tolerance, dependencies on providers, testing approach and governance, reviewed at least annually.