Showing 65 controls
Requires threat-led penetration testing for critical entities.
The goal is to ensure that appropriate safeguards are in place and effective.
Amends existing laws to align with DORA.
The goal is to ensure that appropriate safeguards are in place and effective.
Brings IORPs (occupational pension funds) under the scope of ICT risk regulation.
The goal is to ensure that appropriate safeguards are in place and effective.
Brings market infrastructures under DORA???s incident management and ICT governance frameworks.
The goal is to ensure that appropriate safeguards are in place and effective.
Amendments to Regulation (EU) No 1060/2009 Introduces amendments to the Credit Rating Agencies Regulation to align with DORA???s requirements.
The goal is to ensure that appropriate safeguards are in place and effective.
Expands the Solvency II framework to address digital resilience in insurance.
The goal is to ensure that appropriate safeguards are in place and effective.
Ensures fund managers also comply with digital operational resilience obligations.
The goal is to ensure that appropriate safeguards are in place and effective.
Internal audits of ICT resilience policies and practices.
The goal is to ensure that appropriate safeguards are in place and effective.
Requires regular, secure backups and recovery processes.
The goal is to ensure that appropriate safeguards are in place and effective.
Mandates internal and external communication plans for incidents.
The goal is to ensure that appropriate safeguards are in place and effective.
Focus on learning from incidents to improve resilience.
The goal is to ensure that appropriate safeguards are in place and effective.
52
The goal is to ensure that appropriate safeguards are in place and effective.
Creates an EU-level oversight structure for critical vendors.
The goal is to ensure that appropriate safeguards are in place and effective.
Criteria used to designate providers as critical.
The goal is to ensure that appropriate safeguards are in place and effective.
Procedures for formally designating critical providers.
The goal is to ensure that appropriate safeguards are in place and effective.
Grants oversight authorities various supervisory rights.
The goal is to ensure that appropriate safeguards are in place and effective.
Defines the obligations of designated providers.
The goal is to ensure that appropriate safeguards are in place and effective.
Outlines how and when designations are reviewed.
The goal is to ensure that appropriate safeguards are in place and effective.
Allows voluntary reports of cyber threats.
The goal is to ensure that appropriate safeguards are in place and effective.
56
The goal is to ensure that appropriate safeguards are in place and effective.
Provides definitions of key terms used in the regulation.
The goal is to ensure that appropriate safeguards are in place and effective.
Defines requirements for detecting ICT anomalies.
The goal is to ensure that appropriate safeguards are in place and effective.
DORA entered into force on Jan 16, 2023, and applies fromxa0Jan 17, 2025, giving entities 2 years to prepare.
The goal is to ensure that appropriate safeguards are in place and effective.
57
The goal is to ensure that appropriate safeguards are in place and effective.
Defines the regulation???s scope and subject matter.
The goal is to ensure that appropriate safeguards are in place and effective.
Outlines ICT governance roles for senior management.
The goal is to ensure that appropriate safeguards are in place and effective.
Details structural organization to manage ICT risk.
The goal is to ensure that appropriate safeguards are in place and effective.
Coherent governance across group-level organizations.
The goal is to ensure that appropriate safeguards are in place and effective.
Sets standards for ICT infrastructure and architecture.
The goal is to ensure that appropriate safeguards are in place and effective.
Specifies the elements of a comprehensive ICT risk framework.
The goal is to ensure that appropriate safeguards are in place and effective.
Steps for handling ICT-related incidents.
The goal is to ensure that appropriate safeguards are in place and effective.
Criteria for categorizing incidents by severity.
The goal is to ensure that appropriate safeguards are in place and effective.
Rules for reporting major ICT-related incidents.
The goal is to ensure that appropriate safeguards are in place and effective.
Specifies deadlines and required content for incident reports.
The goal is to ensure that appropriate safeguards are in place and effective.
Information exchange between competent authorities.
The goal is to ensure that appropriate safeguards are in place and effective.
Facilitates international collaboration on ICT matters.
The goal is to ensure that appropriate safeguards are in place and effective.
Empowers the EC to create delegated acts.
The goal is to ensure that appropriate safeguards are in place and effective.
53
The goal is to ensure that appropriate safeguards are in place and effective.
Mandates controls to prevent ICT incidents.
The goal is to ensure that appropriate safeguards are in place and effective.
Explains proportional application of DORA based on entity type.
The goal is to ensure that appropriate safeguards are in place and effective.
55
The goal is to ensure that appropriate safeguards are in place and effective.
54
The goal is to ensure that appropriate safeguards are in place and effective.
Entities must maintain a complete incident register.
The goal is to ensure that appropriate safeguards are in place and effective.
Establishes how to respond to and recover from incidents.
The goal is to ensure that appropriate safeguards are in place and effective.
Regular reports to national regulators.
The goal is to ensure that appropriate safeguards are in place and effective.
Cancels any prior conflicting regulation.
The goal is to ensure that appropriate safeguards are in place and effective.
Specifies review timelines and criteria.
The goal is to ensure that appropriate safeguards are in place and effective.
58
The goal is to ensure that appropriate safeguards are in place and effective.
Requires alignment of resilience strategy with business strategy.
The goal is to ensure that appropriate safeguards are in place and effective.
Defines ESAs??? supervisory and coordinating roles.
The goal is to ensure that appropriate safeguards are in place and effective.
Clarifies ECB involvement in oversight activities.
The goal is to ensure that appropriate safeguards are in place and effective.
Defines the scope of digital resilience testing.
The goal is to ensure that appropriate safeguards are in place and effective.
Details tools for vulnerability and performance testing.
The goal is to ensure that appropriate safeguards are in place and effective.
Sets out coordinated testing protocols with authorities.
The goal is to ensure that appropriate safeguards are in place and effective.
Mandates risk controls for ICT third-party services.
The goal is to ensure that appropriate safeguards are in place and effective.
Providers must be vetted prior to engagement.
The goal is to ensure that appropriate safeguards are in place and effective.
Contracts must include specific operational clauses.
The goal is to ensure that appropriate safeguards are in place and effective.
Entities must monitor provider performance regularly.
The goal is to ensure that appropriate safeguards are in place and effective.
Describes conditions for sub-outsourcing ICT services.
The goal is to ensure that appropriate safeguards are in place and effective.
Procedures for terminating contracts safely.
The goal is to ensure that appropriate safeguards are in place and effective.
Requires exit and transition strategies for continuity.
The goal is to ensure that appropriate safeguards are in place and effective.
Encourages participation in threat intel sharing.
The goal is to ensure that appropriate safeguards are in place and effective.
Defines grace periods and compliance transition steps.
The goal is to ensure that appropriate safeguards are in place and effective.
Helps firms prepare compliance frameworks before enforcement; mirrors practices seen in GDPR rollouts.
The goal is to ensure that appropriate safeguards are in place and effective.
Establish and maintain a configuration management database (CMDB) to contain relevant information about configuration items.
Desired outcome.