PECB DORA Foundation flashcards

32 cards. Read the term and the definition here. The deck at the top of this page is optional.

Digital operational resilience

The ability of a financial entity to build, assure and review its operational integrity and reliability by ensuring, directly or through third parties, the full range of ICT capabilities needed to withstand, respond to and recover from disruptions.

ICT risk

Any reasonably identifiable circumstance relating to the use of network and information systems that, if it materialises, may compromise the security of those systems or the data, processes and operations they support.

DORA legal instrument type

DORA is an EU regulation (Regulation (EU) 2022/2554), so it applies directly in every Member State without national transposition and overrides conflicting sectoral rules on ICT risk and incident reporting.

DORA five pillars

The framework rests on five pillars: ICT risk management, incident management and reporting, digital operational resilience testing, ICT third-party risk management, and information sharing on cyber threat intelligence.

Critical or important function

A function whose disruption would materially impair the financial entity's financial performance, the soundness or continuity of its services, or its compliance with authorisation conditions and obligations.

Proportionality under DORA

The ICT risk management framework must be proportionate to the entity's size, business and risk profile and the complexity of its services; simplified arrangements apply to certain small and non-interconnected entities.

Management body accountability

The management body defines, approves and oversees the digital operational resilience strategy and bears ultimate responsibility for ICT risk; this accountability cannot be outsourced to a third party.

Critical ICT third-party provider

An ICT provider designated by the European Supervisory Authorities based on systemic impact, the number of financial entities relying on it, substitutability and dependence on its services.

ICT third-party risk

The risk of disruption, degradation or data compromise arising from the use of ICT services provided by external providers, including sub-outsourcing chains and concentration on a single provider.

ICT incident vs ICT-related incident

An ICT incident is a single or series of linked events compromising ICT security; an ICT-related incident is one having an adverse impact on the digital operational resilience of the entity or its clients.

Digital operational resilience strategy

A document explaining how the entity implements the ICT risk management framework, including risk tolerance, risk mitigation targets, governance arrangements and the approach to third-party ICT dependencies.

ICT concentration risk

The risk that reliance on a small number of ICT providers, or on hard-to-substitute services, means a single failure or exit could disrupt several critical or important functions at once.

Information-sharing arrangement

A voluntary arrangement among financial entities to exchange cyber threat information and intelligence, provided it protects confidential data, personal data and trade secrets and complies with competition law.

ICT asset inventory

A maintained record of all ICT assets, their configuration, interdependencies and third-party arrangements, granular enough to support risk assessment, incident response and recovery prioritisation.

Three lines of defence

The internal control structure comprising an ICT risk management function, an independent risk oversight or compliance function, and an independent internal audit function, which may be internal or external.

ICT risk management framework

A documented set of policies, procedures, protocols and tools covering the whole ICT lifecycle, reviewed at least annually and after major incidents or significant changes to the business.

Business impact analysis

An analysis identifying critical or important functions, their ICT dependencies and acceptable disruption limits, used to set recovery time and recovery point objectives.

Recovery time objective

The maximum acceptable time to restore a function or system after disruption; it must be set for critical functions and validated through actual restoration testing.

Recovery point objective

The maximum acceptable amount of data loss measured in time before a disruption; it drives backup frequency and must be consistent with the criticality of the function.

Backup and restoration policy

A policy defining backup scope, frequency, retention, encryption and separate secure storage, plus restoration procedures that must be tested periodically rather than only documented.

Management body ICT expertise

At least one member of the management body, or a dedicated committee, must have sufficient ICT and security knowledge, and members must receive regular training on ICT risk.

Major ICT-related incident

An incident meeting the classification thresholds on impact, duration, geographic spread, data loss, criticality of affected services and economic impact, triggering reporting to the competent authority.

Incident reporting timelines

DORA requires an initial notification, an intermediate report and a final report to the competent authority within prescribed deadlines after classification of a major ICT-related incident.

Digital operational resilience testing

A risk-based testing programme covering vulnerability assessments, scenario-based tests and, for significant entities, threat-led penetration testing at least every three years.

Threat-led penetration testing

An advanced, intelligence-led test mimicking real threat actors, required for entities identified as significant, performed at least every three years and covering critical production systems.

ICT change management

A documented procedure for planning, approving, testing and recording changes to ICT systems, ensuring segregation of duties and preventing unauthorised or untested modifications.

Access control policy

Rules defining who may access which systems and data, based on least privilege and need-to-know, with strong authentication, periodic access reviews and prompt removal on role change.

Cryptographic controls

Requirements for encryption, key management and secure protocols applied to data in transit, at rest and in use, proportionate to the sensitivity of the data and the criticality of the system.

Crisis communication plan

A plan setting out internal and external communication roles, channels and templates to be used during ICT disruptions, including communication with clients, authorities and the public where required.

ICT risk tolerance level

The maximum level of ICT risk the entity is willing to accept, defined and approved by the management body and expressed in measurable terms within the resilience strategy.

Simplified ICT risk framework

A reduced set of requirements available to certain small and non-interconnected entities, still covering inventory, continuity, access control and incident logging but with lighter governance and testing expectations.

Register of information

A register of all contractual arrangements with ICT third-party providers, maintained and reported to competent authorities, identifying the services, the providers and the supported functions.