PECB DORA Foundation key terms

The ability of a financial entity to build, assure and review its operational integrity and reliability by ensuring, directly or through third parties, the full range of ICT-related capabilities needed to address security of networks and information systems.

Any reasonably identifiable circumstance in relation to the use of networks and information systems that, if it materialises, may compromise the security of networks and information systems, or the availability, authenticity, integrity or confidentiality of data or services.

An undertaking such as a credit institution, payment institution, investment firm, insurance undertaking, crypto-asset service provider or crowdfunding service provider that falls within the scope of the regulation and must therefore apply its ICT risk rules.

A single event or a series of linked events, unplanned by the entity, that has or may have an adverse impact on the security of networks and information systems supporting business processes or the delivery of services.

An incident classified as significant under the criteria set in the regulation, typically affecting critical services, clients, transactions, duration, geographical spread or data losses, and triggering notification duties to competent authorities.

A function whose disruption would materially impair the financial entity's compliance, financial performance, soundness or continuity of services, assessed against criteria such as substitutability, dependencies and impact on clients.

An undertaking providing digital services through contractual arrangements, including cloud platforms, data analytics, data centres and ICT support services, which may expose the financial entity to additional operational and concentration risks.

The exposure arising when a financial entity relies on a small number of ICT providers, or on providers that are hard to replace, so that a single failure or disruption could affect many services at once.

The principle that controls and governance arrangements should match the entity's size, business profile, risk exposure and complexity, while still meeting the regulation's core requirements for resilience.

The documented set of strategies, policies, procedures, tools and organisational arrangements through which a financial entity identifies, protects against, detects, responds to and recovers from ICT risk.

A high-level document defining the entity's risk appetite and tolerance for ICT risk, its objectives for digital operational resilience and how those objectives link to its overall business strategy.

The maximum level of ICT risk an entity is willing to accept in pursuit of its objectives, expressed in qualitative or quantitative terms and used to set thresholds for decisions and escalation.

The entity's governing organ, which bears ultimate responsibility for the ICT risk management framework, approves the strategy and policies, sets roles and oversees implementation and remediation of findings.

An organisational model in which business units own and manage risk, a separate risk and compliance function oversees it, and internal audit provides independent assurance over the framework's effectiveness.

The allocation of responsibilities, reporting lines, approval paths and control activities that ensure ICT risk decisions are taken by accountable persons and can be challenged and verified.

A maintained register of hardware, software, data, systems and dependencies, with ownership and criticality ratings, forming the basis for mapping risk, controls and incident impact.

A structured assessment identifying which processes and functions matter most, what disruption would cost, and how quickly they must be restored, used to set recovery objectives and resilience priorities.

The maximum acceptable period for restoring a process or system after disruption, agreed in advance and used to design continuity, backup and recovery arrangements.

The maximum acceptable amount of data loss measured in time, determining how frequently backups or replication must occur for a given system or process.

The documented rules and plans that keep critical functions running during disruption, including continuity strategies, crisis communication, alternate arrangements and periodic testing of those plans.

The technical plan describing how ICT systems, data and infrastructure are restored after an outage, including roles, dependencies, backup sources and validated restoration steps.

Rules specifying what data and configurations are copied, how often, where copies are stored, how access is restricted and how restoration is tested to prove recoverability.

The defined sequence for logging, classifying, escalating, containing, resolving and learning from ICT incidents, with clear ownership, timelines and communication paths.

The obligation to notify competent authorities of major ICT-related incidents within set deadlines, using prescribed templates and including initial, intermediate and final reports.

The use of logging, alerting and behavioural analysis to spot unusual activity or degraded performance early, so incidents are found before they cause significant harm.

A repeatable cycle of identifying, classifying, prioritising and remediating technical weaknesses in systems and software, supported by tracking and verification of fixes.

The controlled process for testing, approving and deploying software updates that close known weaknesses, with records showing what was applied and when.

The process for assessing, approving, testing, documenting and rolling back changes to ICT systems, aiming to prevent disruptions caused by unplanned or poorly controlled modifications.

Maintaining an accurate, controlled record of how systems are set up, including baselines and deviations, so that unauthorised or unsafe settings can be detected and corrected.

The rules and mechanisms limiting who and what can reach systems and data, based on least privilege, strong authentication and periodic review of entitlements.

The lifecycle process for creating, changing and removing user identities and their rights, ensuring that access reflects current roles and that leavers lose access promptly.

Access rights that allow administrative control over systems, requiring stricter safeguards such as separate accounts, logging, approval and time-limited elevation.

The use of cryptographic techniques to protect data in transit and at rest, including key management practices that keep keys secure and rotate them when needed.

Safeguards for the availability, authenticity, integrity and confidentiality of data, covering classification, storage, transmission, retention and disposal practices.

The technical and organisational measures that segment, filter and monitor network traffic so that intrusions and lateral movement are prevented or detected quickly.

Information about current attackers, techniques and indicators that is collected and used to sharpen detection rules, prioritise patching and inform risk assessments.

Authorised, controlled attempts to breach systems in order to validate the effectiveness of controls, identify exploitable weaknesses and test detection and response.

A scenario-based test that emulates the tactics of realistic threat actors against critical functions, involving internal teams and, where required, external testers and authorities.

An independent function that reviews the design and operation of the ICT risk framework and reports findings and recommendations to the management body.

A documented plan for terminating an ICT service arrangement, covering data retrieval, migration, minimum service periods and avoidance of disruption to critical functions.