DORA Lead Manager flashcards

32 cards. Read the term and the definition here. The deck at the top of this page is optional.

DORA scope

DORA applies to a wide range of financial entities including credit institutions, payment institutions, investment firms, and insurers, as well as critical ICT third-party providers designated by ESAs.

Digital operational resilience

The ability of a financial entity to build, assure, and review the operational integrity and reliability of its ICT systems, ensuring continuity of financial services during disruptions.

ICT risk definition

Any reasonably identifiable circumstance related to ICT that, if materialized, may compromise the security of network and information systems, impacting the financial entity's operations.

Management body responsibility

The management body holds ultimate responsibility for ICT risk, including defining risk appetite, approving policies, and ensuring adequate resources for DORA compliance.

Proportionality principle

DORA requirements apply proportionally to the entity's size, business profile, and risk exposure, but core obligations such as incident reporting and risk management remain mandatory.

Register of information

A detailed record of all contractual arrangements with ICT third-party providers, including subcontractors, which financial entities must maintain and report to supervisors annually.

Gap analysis

A systematic comparison of current ICT risk management, incident reporting, testing, and third-party oversight practices against DORA articles and technical standards to identify deficiencies.

DORA programme lead

The appointed individual responsible for coordinating the DORA implementation project, ensuring alignment across business, IT, risk, compliance, and legal functions.

Target operating model

A blueprint describing how DORA obligations will be integrated into existing processes, roles, and technologies to achieve compliance and operational resilience.

Implementation roadmap

A phased plan outlining assessment, design, implementation, testing, and improvement stages, including milestones, dependencies, and resource allocation for DORA compliance.

Stakeholder engagement

Early and ongoing communication with supervisors, internal audit, and third-party providers to align expectations, gather data, and manage DORA implementation risks.

DORA compliance charter

A formal document defining the scope, governance, roles, and responsibilities for DORA implementation, ensuring accountability and version-controlled documentation.

Change management

The process of communicating DORA impacts to staff and providing training to ensure smooth adoption of new processes and technologies across the organization.

KPIs and KRIs

Key performance indicators and key risk indicators used to track DORA implementation progress and effectiveness, reported regularly to the management body.

ICT risk management framework

A comprehensive set of policies, procedures, and controls covering identification, protection, detection, response, recovery, and learning for ICT risks, aligned with standards like ISO 27001.

Major ICT-related incident

An incident with material impact on critical services, affecting clients, counterparties, or market integrity, requiring immediate classification and reporting to competent authorities.

Incident reporting timeline

Major incidents must be reported to authorities within 4 hours of classification, followed by intermediate and final reports according to regulatory technical standards.

Incident response plan

A documented set of procedures defining roles, escalation paths, communication protocols, and post-incident reviews, tested at least annually to ensure effectiveness.

Business continuity policy

A policy ensuring ICT continuity and disaster recovery, including regular testing at least annually or after significant changes, to maintain critical operations during disruptions.

Root cause analysis

A systematic process to identify the underlying causes of major ICT incidents, document lessons learned, and implement corrective actions to prevent recurrence.

Incident logging

The recording of all ICT-related incidents, including near misses, with sufficient detail to support classification, reporting, and analysis for continuous improvement.

Third-party incident notification

Contractual obligation for ICT providers to notify the financial entity without undue delay of incidents that may affect the entity's services, aiding timely regulatory reporting.

Risk-based testing programme

A testing approach covering all critical ICT systems and processes, including vulnerability assessments, scenario-based tests, and penetration testing, prioritized by risk.

Threat-led penetration testing

Advanced testing (TLPT) required at least every three years for significant entities, simulating real-world attacks on live production systems to assess resilience.

Third-party due diligence

Pre-contract assessment of ICT providers' security, resilience, and compliance, followed by ongoing monitoring and exit strategy planning to manage concentration risk.

Mandatory contractual clauses

DORA requires contracts with ICT providers to include clauses on service levels, audit rights, incident notification, data location, subcontracting, and termination rights.

Critical third-party provider

An ICT third-party service provider designated by ESAs as critical to the financial sector, subject to an oversight framework including recommendations and penalties.

Concentration risk

The risk arising from dependency on a small number of ICT providers, which financial entities must assess and manage through diversification and substitutability planning.

Exit strategy

A documented plan ensuring the ability to migrate or discontinue ICT services without disruption, tested periodically and included in contractual arrangements.

Annual review requirement

The management body must review and approve the ICT risk management framework at least once a year or after significant changes, ensuring ongoing relevance.

Internal audit role

Independent review of the ICT risk management framework and DORA compliance at least annually, reporting findings to the management body for corrective action.

PDCA cycle

Plan-Do-Check-Act methodology applied to DORA compliance, enabling continual improvement through setting objectives, implementing changes, monitoring results, and adjusting.