DORA

Who it applies to

Most EU financial entities, including banks, investment firms, payment and e-money institutions, insurers, crypto-asset service providers and trading venues, plus ICT third-party service providers designated as critical.

Key requirements

• An ICT risk-management framework owned by the management body.
• Classification and reporting of major ICT-related incidents to the competent authority.
• Digital operational resilience testing, including threat-led penetration testing for selected entities.
• ICT third-party risk management, including a register of information on ICT contracts and mandatory contract terms.
• Voluntary sharing of cyber threat information between financial entities.

Breach and incident notification

Major ICT-related incidents are reported to the competent authority in stages (initial notification, intermediate report and final report). The exact deadlines are set in the accompanying technical standards; check them in the official text.

Penalties

Penalties are set by Member States and competent authorities. Critical ICT third-party providers can face periodic penalty payments from the lead overseer. Check national implementation for amounts.

Go deeper