Fundamental concepts of ICT risk management and digital operational resilience
This domain tests whether you can explain DORA's purpose, scope and core definitions, and distinguish digital operational resilience from narrower cybersecurity compliance.
Core rules and concepts
- DORA is Regulation (EU) 2022/2554, applying from 17 January 2025. It is technology-neutral and covers all ICT risk, not only malicious cyber events.
- Digital operational resilience means the ability to build, assure and review operational integrity and security, ensure continuity of ICT services, and withstand, absorb and recover from disruptions.
- The regulation rests on five pillars: ICT risk management, ICT-related incident management and reporting, digital operational resilience testing, ICT third-party risk management, and information sharing.
- Scope covers a broad list of financial entities and designated critical ICT third-party providers (CTPPs). Proportionality reduces some burdens for small and micro enterprises but does not remove core obligations.
- The management body is accountable: it defines risk tolerance, approves and oversees the ICT risk management framework, allocates budget and must have sufficient knowledge.
Worked example
A payment institution suffers a cloud outage that delays transfers for two hours. Staff argue DORA reporting does not apply because there was no cyberattack. The correct analysis is that an ICT incident includes any event compromising availability, authenticity, integrity or confidentiality of ICT systems; malicious intent is not required. The outage must be assessed against the major-incident criteria and, if major, reported.
Traps that cost marks
- Treating DORA as identical to NIS2 or GDPR. DORA is sector-specific and broader on ICT risk than privacy or cybercrime.
- Assuming outsourcing transfers regulatory accountability. The financial entity remains responsible.
- Reducing resilience to disaster recovery only; DORA also covers prevention, detection, response, learning and governance.
- Ignoring evidence of management-body oversight, which examiners often test through scenario questions.