DORA Lead Manager key terms

The risk of loss, disruption, or harm arising from the use of information and communication technology, including from failures, cyber attacks, or inadequate internal controls over digital systems.

The ability of a financial entity to build, assure, and review its operational integrity and reliability by ensuring it can withstand all types of ICT disruption and continue delivering services within acceptable limits.

A single event or a series of linked events, whether malicious or accidental, that disrupts or is likely to disrupt the security of network and information systems and the availability, authenticity, integrity, or confidentiality of data.

An ICT-related incident meeting classification criteria set in the regulation, judged by clients affected, duration, geographic spread, data losses, criticality of services, and economic impact, and therefore subject to reporting to supervisors.

A function, process, or service whose disruption would materially impair the financial entity's financial performance, soundness, or continuity of regulated activities, assessed against criteria such as substitutability and impact on clients.

Any hardware, software, data, network component, or supporting infrastructure used to deliver ICT services, which must be identified and inventoried so that risks to it can be managed and mapped.

The documented set of policies, procedures, governance arrangements, and controls through which an entity identifies, protects against, detects, responds to, and recovers from ICT risk, reviewed at least annually.

A governance model in which operational units own and manage risk, an independent risk and compliance function oversees it, and internal audit provides independent assurance over the whole control environment.

An independent, objective assurance function that reviews and tests the ICT risk management framework and controls, reports findings to the management body, and follows up on remediation of identified gaps.

The governing organ of a financial entity, such as the board, that bears ultimate responsibility for ICT risk, approves the resilience strategy and risk appetite, and oversees its implementation and periodic review.

The level and type of ICT risk an entity is willing to accept in pursuit of its objectives, expressed in qualitative and quantitative terms and used to guide decisions on controls, testing, and outsourcing.

The concrete, measurable thresholds that translate the risk appetite into operational limits, such as maximum downtime, incident frequency, or acceptable loss levels for specific services and systems.

A structured record of identified ICT risks, their owners, likelihood and impact assessments, linked controls, and treatment status, maintained as a living tool for monitoring and reporting.

The process of selecting and applying options to address an identified risk, such as mitigating through controls, transferring through insurance or contracts, avoiding the activity, or consciously accepting the residual risk.

The level of ICT risk that remains after controls and treatments have been applied, which must be assessed against risk tolerance and formally accepted or escalated by the appropriate owner.

A structured assessment that identifies critical business services, maps their dependence on ICT assets and third parties, and quantifies the operational and financial consequences of disruption over time.

The maximum acceptable time to restore a service or system after disruption, used to design recovery arrangements and to test whether resilience capabilities match business needs.

The maximum acceptable amount of data loss measured in time, defining how far back a restoration may reach and therefore how frequently backups and replication must occur.

Documented arrangements describing how an entity maintains or restores critical or important functions during and after disruption, including roles, alternate resources, and communication and escalation paths.

The technical component of continuity planning that sets out how ICT systems, data, and infrastructure are restored after a major failure, including backup restoration, failover, and validation steps.

A policy defining how an entity maintains the availability and resilience of ICT services, aligned with continuity objectives and tested periodically to confirm that recovery capabilities remain effective.

The process of assessing an ICT-related incident against defined criteria to determine whether it is major and to set the severity level, triggering escalation, reporting, and response obligations.

The submission of information about major ICT-related incidents to competent authorities using prescribed templates and deadlines, typically covering initial notification, intermediate updates, and a final report.

A structured investigation to determine the underlying reasons an incident occurred, so that corrective actions address causes rather than symptoms and prevent recurrence.

A time-bound plan listing corrective actions, responsible owners, and deadlines to close control weaknesses identified through incidents, audits, or testing, with tracked completion and verification.

A risk-based programme of assessments, including vulnerability scans, scenario-based exercises, and advanced tests, designed to verify that systems can withstand disruption and that controls work in practice.

An advanced, intelligence-based test that mimics realistic attacker behaviour against critical functions and systems, performed under defined scope, governance, and safeguards by qualified testers.

A simulated adversarial exercise combining technical intrusion attempts with physical or social engineering tactics to test detection and response capabilities, not only preventive controls.

A systematic scan and review of systems to identify known weaknesses, misconfigurations, and missing patches, ranked by severity and feeding into a prioritised remediation process.

An external undertaking providing ICT services to a financial entity, including cloud, software, data, and infrastructure providers, whose risks must be managed throughout the contractual lifecycle.

A provider designated by supervisors as critical because of its systemic importance, size, or concentration of services to financial entities, and therefore subject to an oversight framework.

The risk arising from reliance on a small number of ICT providers or on closely interconnected providers, which can amplify the impact of a single failure or contractual dispute across the entity.

A documented plan for terminating an ICT service arrangement, including data retrieval, transition to another provider or in-house solution, and the resources and time needed to do so without disruption.

A structured record of all contractual arrangements with ICT third-party service providers, capturing provider details, services, criticality, and contract terms, reported periodically to competent authorities.

A voluntary agreement among financial entities to exchange cyber threat intelligence and indicators of compromise, subject to safeguards on confidentiality, data protection, and use of shared information.

Information about current and emerging threats, including actors, tactics, and indicators, that is collected and analysed to inform defensive measures, testing scenarios, and incident detection.

A structured post-event or post-project review that captures what worked, what failed, and what should change, converting findings into tracked improvements in the resilience framework.

A sequenced plan for achieving compliance, setting milestones, dependencies, owners, and resources for activities such as gap assessment, policy drafting, testing, and register build-out.

A structured comparison of current practices against regulatory requirements and good practice, producing a prioritised list of deficiencies that feeds the implementation roadmap.