DORA

Preamble (Recital 1 – 106)

Recitals

Chapter I (Article 1 – 4)

General provisions

Article 1

Subject matter

Article 2

Scope

Article 3

Definitions

Article 4

Proportionality principle

Chapter II (Article 5 – 16)

ICT risk management

Section I

Article 5

Governance and organisation

Section II

Article 6

ICT risk management framework

Article 7

ICT systems, protocols and tools

Article 8

Identification

Article 9

Protection and prevention

Article 10

Detection

Article 11

Response and recovery

Article 12

Backup policies and procedures, restoration and recovery procedures and methods

Article 13

Learning and evolving

Article 14

Communication

Article 15

Further harmonisation of ICT risk management tools, methods, processes and policies

Article 16

Simplified ICT risk management framework

Chapter III (Article 17 – 23)

ICT-related incident management, classification and reporting

Article 17

ICT-related incident management process

Article 18

Classification of ICT-related incidents and cyber threats

Article 19

Reporting of major ICT-related incidents and voluntary notification of significant cyber threats

Article 20

Harmonisation of reporting content and templates

Article 21

Centralisation of reporting of major ICT-related incidents

Article 22

Supervisory feedback

Article 23

Operational or security payment-related incidents concerning credit institutions, payment institutions

Chapter IV (Article 24 – 27)

Digital operational resilience testing

Article 24

General requirements for the performance of digital operational resilience testing

Article 25

Testing of ICT tools and systems

Article 26

Advanced testing of ICT tools, systems and processes based on TLPT

Article 27

Requirements for testers for the carrying out of TLPT

Chapter V (Article 28 – 44)

Managing of ICT third-party risk

Section I

Key principles for a sound management of ICT third-party risk

Article 28

General principles

Article 29

Preliminary assessment of ICT concentration risk at entity level

Article 30

Key contractual provisions

Section II

Oversight framework of critical ITC third-party service providers

Article 31

Designation of critical ICT third-party service providers

Article 32

Structure of the Oversight Framework

Article 33

Tasks of the Lead Overseer

Article 34

Operational coordination between Lead Overseers

Article 35

Powers of the Lead Overseer

Article 36

Exercise of the powers of the Lead Overseer outside the Union

Article 37

Request for information

Article 38

General investigations

Article 39

Inspections

Article 40

Ongoing oversight

Article 41

Harmonisation of conditions enabling the conduct of the oversight activities

Article 42

Follow-up by competent authorities

Article 43

Oversight fees

Article 44

International cooperation

Chapter VI (Article 45 – 45)

Information-sharing arrangements

Article 45

Information-sharing arrangements on cyber threat information and intelligence

Chapter VII (Article 46 – 56)

Competent authorities

Article 46

Competent authorities

Article 47

Cooperation with structures and authorities established by Directive (EU) 2022/2555

Article 48

Cooperation between authorities

Article 49

Financial cross-sector exercises, communication and cooperation

Article 50

Administrative penalties and remedial measures

Article 51

Exercise of the power to impose administrative penalties and remedial measures

Article 52

Criminal penalties

Article 53

Notification duties

Article 54

Publication of administrative penalties

Article 55

Professional secrecy

Article 56

Data Protection

Chapter VIII (Article 57 – 57)

Delegated acts

Article 57

Exercise of the delegation

Chapter IX (Article 58 – 64)

Transitional and final provisions

Section I

Article 58

Review clause

Section II

Amendments

Article 59

Amendments to Regulation (EC) No 1060/2009

Article 60

Amendments to Regulation (EU) No 648/2012

Article 61

Amendments to Regulation (EU) No 909/2014

Article 62

Amendments to Regulation (EU) No 600/2014

Article 63

Amendment to Regulation (EU) 2016/1011

Article 64

Entry into force and application

Article 19

Reporting of major ICT-related incidents and voluntary notification of significant cyber threats

TL;DR The Digital Operations Resilience Act from the EU states that financial entities must report major ICT-related incidents to the relevant competent authority within a certain time frame. Credit institutions deemed significant must report such incidents to relevant national competent authorities, who can then transmit the reports to the ECB. These reports should include all necessary information for the competent authority to assess possible cross-border impacts, and Member States may additionally require that these reports be sent to designated or established CSIRTs. Financial entities may also, on a voluntary basis, notify significant cyber threats to the relevant competent authority. In the case of a major ICT-related incident, clients must be informed without undue delay. These reporting obligations may be outsourced to a third-party service provider, but the financial entity remains responsible for their fulfilment. Upon receipt of the reports, the competent authority shall inform other relevant public authorities based on their competences. EBA, ESMA, or EIOPA and the ECB shall assess the incidents and notify relevant competent authorities in other Member States, while the ECB shall notify the members of the European System of Central Banks. ESMA has responsibility to notify competent authorities in host Member States if there is significant cross-border activity.

  1. Financial entitiesas defined in Article 2, points (a) to (t) shall report major ICT-related incidentsan ICT-related incident that has a high adverse impact on the network and information systems that support critical or important functions of the financial entity to the relevant competent authorityas defined in Article 46 as referred to in Article 46 in accordance with paragraph 4 of this Article.

    Where a financial entity is subject to supervision by more than one national competent authorityas defined in Article 46 referred to in Article 46, Member States shall designate a single competent authorityas defined in Article 46 as the relevant competent authorityas defined in Article 46 responsible for carrying out the functions and duties provided for in this Article.

    Credit institutionsa credit institution as defined in Article 4(1), point (1), of Regulation (EU) No 575/2013 of the European Parliament and of the Council classified as significant, in accordance with Article 6(4) of Regulation (EU) No 1024/2013, shall report major ICT-related incidentsan ICT-related incident that has a high adverse impact on the network and information systems that support critical or important functions of the financial entity to the relevant national competent authorityas defined in Article 46 designated in accordance with Article 4 of Directive 2013/36/EU which shall immediately transmit that report to the ECB.

    For the purpose of the first subparagraph, financial entitiesas defined in Article 2, points (a) to (t) shall produce, after collecting and analysing all relevant information, the initial notification and reports referred to in paragraph 4 of this Article using the templates referred to in Article 20 and submit them to the competent authorityas defined in Article 46. In the event that a technical impossibility prevents the submission of the initial notification using the template, financial entitiesas defined in Article 2, points (a) to (t) shall notify the competent authorityas defined in Article 46 about it via alternative means.

    The initial notification and reports referred to in paragraph 4 shall include all information necessary for the competent authorityas defined in Article 46 to determine the significance of the major ICT-related incidentan ICT-related incident that has a high adverse impact on the network and information systems that support critical or important functions of the financial entity and assess possible cross-border impacts.

    Without prejudice to the reporting pursuant to the first subparagraph by the financial entity to the relevant competent authorityas defined in Article 46, Member States may additionally determine that some or all financial entitiesas defined in Article 2, points (a) to (t) shall also provide the initial notification and each report referred to in paragraph 4 of this Article using the templates referred to in Article 20 to the competent authoritiesas defined in Article 46 or the computer security incident response teams (CSIRTscomputer security incident response teams) designated or established in accordance with Directive (EU) 2022/2555.

    RTS Paragraph is expanded on in a regulatory technical standard.
    exemption Paragraph has a reduced scope, i.e., it does not apply to all financial entities in Article 2(1) but some or only those of a certain size.

  2. Financial entitiesas defined in Article 2, points (a) to (t) may, on a voluntary basis, notify significant cyber threatsa cyber threat the technical characteristics of which indicate that it could have the potential to result in a major ICT-related incident or a major operational or security payment-related incident to the relevant competent authorityas defined in Article 46 when they deem the threat to be of relevance to the financial system, service users or clients. The relevant competent authorityas defined in Article 46 may provide such information to other relevant authorities referred to in paragraph 6.

    Credit institutionsa credit institution as defined in Article 4(1), point (1), of Regulation (EU) No 575/2013 of the European Parliament and of the Council classified as significant, in accordance with Article 6(4) of Regulation (EU) No 1024/2013, may, on a voluntary basis, notify significant cyber threatsa cyber threat the technical characteristics of which indicate that it could have the potential to result in a major ICT-related incident or a major operational or security payment-related incident to relevant national competent authorityas defined in Article 46, designated in accordance with Article 4 of Directive 2013/36/EU, that shall immediately transmit the notification to the ECB.

    Member States may determine that those financial entitiesas defined in Article 2, points (a) to (t) that on a voluntary basis notify in accordance with the first subparagraph may also transmit that notification to the CSIRTscomputer security incident response teams designated or established in accordance with Directive (EU) 2022/2555.

    RTS Paragraph is expanded on in a regulatory technical standard.
    ITS Paragraph is expanded on in a implementing technical standard.
    exemption Paragraph has a reduced scope, i.e., it does not apply to all financial entities in Article 2(1) but some or only those of a certain size.

  3. Where a major ICT-related incidentan ICT-related incident that has a high adverse impact on the network and information systems that support critical or important functions of the financial entity occurs and has an impact on the financial interests of clients, financial entitiesas defined in Article 2, points (a) to (t) shall, without undue delay as soon as they become aware of it, inform their clients about the major ICT-related incidentan ICT-related incident that has a high adverse impact on the network and information systems that support critical or important functions of the financial entity and about the measures that have been taken to mitigate the adverse effects of such incident.

    In the case of a significant cyber threata cyber threat the technical characteristics of which indicate that it could have the potential to result in a major ICT-related incident or a major operational or security payment-related incident, financial entitiesas defined in Article 2, points (a) to (t) shall, where applicable, inform their clients that are potentially affected of any appropriate protection measures which the latter may consider taking.

  4. Financial entitiesas defined in Article 2, points (a) to (t) shall, within the time-limits to be laid down in accordance with Article 20, first subparagraph, point (a), point (2), submit the following to the relevant competent authorityas defined in Article 46:

    1. an initial notification;

    2. an intermediate report after the initial notification referred to in point (a), as soon as the status of the original incident has changed significantly or the handling of the major ICT-related incidentan ICT-related incident that has a high adverse impact on the network and information systems that support critical or important functions of the financial entity has changed based on new information available, followed, as appropriate, by updated notifications every time a relevant status update is available, as well as upon a specific request of the competent authorityas defined in Article 46;

    3. a final report, when the root cause analysis has been completed, regardless of whether mitigation measures have already been implemented, and when the actual impact figures are available to replace estimates.

    RTS Paragraph is expanded on in a regulatory technical standard.

  5. Financial entitiesas defined in Article 2, points (a) to (t) may outsource, in accordance with Union and national sectoral law, the reporting obligations under this Article to a third-party service provider. In case of such outsourcing, the financial entity remains fully responsible for the fulfilment of the incident reporting requirements.

  6. Upon receipt of the initial notification and of each report referred to in paragraph 4, the competent authorityas defined in Article 46 shall, in a timely manner, provide details of the major ICT-related incidentan ICT-related incident that has a high adverse impact on the network and information systems that support critical or important functions of the financial entity to the following recipients based, as applicable, on their respective competences:

    1. EBA, ESMA or EIOPA;

    2. the ECB, in the case of financial entitiesas defined in Article 2, points (a) to (t) referred to in Article 2(1), points (a), (b) and (d);

    3. the competent authoritiesas defined in Article 46, single points of contact or CSIRTscomputer security incident response teams designated or established in accordance with Directive (EU) 2022/2555;

    4. the resolution authorities, as referred to in Article 3 of Directive No 2014/59/EU, and the Single Resolution Board (SRBdefined in-line) with respect to entities referred to in Article 7(2) (37)Regulation (EU) No 806/2014 of the European Parliament and of the Council of 15 July 2014 establishing uniform rules and a uniform procedure for the resolution of credit institutions and certain investment firms in the framework of a Single Resolution Mechanism and a Single Resolution Fund and amending Regulation (EU) No 1093/2010 (OJ L 225, 30.7.2014, p. 1). of Regulation (EU) No 806/2014 of the European Parliament and of the Council, and with respect to entities and groupsa group as defined in Article 2, point (11), of Directive 2013/34/EU referred to in Article 7(4)(b) and (5) of Regulation (EU) No 806/2014 if such details concern incidents that pose a risk to ensuring critical functions within the meaning of Article 2(1), point (35), of Directive 2014/59/EU; and

    5. other relevant public authoritiesany government or other public administration entity, including national central banks under national law.

    RTS Paragraph is expanded on in a regulatory technical standard.

  7. Following receipt of information in accordance with paragraph 6, EBA, ESMA or EIOPA and the ECB, in consultation with ENISA and in cooperation with the relevant competent authorityas defined in Article 46, shall assess whether the major ICT-related incidentan ICT-related incident that has a high adverse impact on the network and information systems that support critical or important functions of the financial entity is relevant for competent authoritiesas defined in Article 46 in other Member States. Following that assessment, EBA, ESMA or EIOPA shall, as soon as possible, notify relevant competent authoritiesas defined in Article 46 in other Member States accordingly. The ECB shall notify the members of the European System of Central Banks on issues relevant to the payment system. Based on that notification, the competent authoritiesas defined in Article 46 shall, where appropriate, take all of the necessary measures to protect the immediate stability of the financial system.

    RTS Paragraph is expanded on in a regulatory technical standard.

  8. The notification to be done by ESMA pursuant to paragraph 7 of this Article shall be without prejudice to the responsibility of the competent authorityas defined in Article 46 to urgently transmit the details of the major ICT-related incidentan ICT-related incident that has a high adverse impact on the network and information systems that support critical or important functions of the financial entity to the relevant authority in the host Member State, where a central securities depositorya central securities depository as defined in Article 2(1), point (1), of Regulation (EU) No 909/2014 has significant cross-border activity in the host Member State, the major ICT-related incidentan ICT-related incident that has a high adverse impact on the network and information systems that support critical or important functions of the financial entity is likely to have severe consequences for the financial markets of the host Member State and where there are cooperation arrangements among competent authoritiesas defined in Article 46 related to the supervision of financial entitiesas defined in Article 2, points (a) to (t).

Table of contents