Data & Privacy
- Data Act
- Data Governance Act
- ePrivacy Directive
- GDPR
AI & Trust
- Artificial Intelligence Act
Cybersecurity
- Cybersecurity Act
- DORA
- NIS2
Digital Services & Media
- Digital Markets Act
- Digital Services Act
- European Media Freedom Act
Digital Operational Resilience Act
- Recitals
CHAPTER I
General provisionsArticles 1 — 4
CHAPTER II
ICT risk managementArticles 5 — 16
CHAPTER III
ICT-related incident management, classification and reportingArticles 17 — 23
CHAPTER IV
Digital operational resilience testingArticles 24 — 27
CHAPTER V
Managing of ICT third-party riskArticles 28 — 44
CHAPTER VI
Information-sharing arrangementsArticles 45 — 45
CHAPTER VII
Competent authoritiesArticles 46 — 56
CHAPTER VIII
Delegated actsArticles 57 — 57
CHAPTER IX
Transitional and final provisionsArticles 58 — 64
Understanding the Digital Operational Resilience Act
Regulation (EU) 2022/2554 of the European Parliament and of the Council of 14 December 2022 on digital operational resilience for the financial sector and amending Regulations (EC) No 1060/2009, (EU) No 648/2012, (EU) No 600/2014, (EU) No 909/2014 and (EU) 2016/1011
14 December 2022
17 January 2025
*EBA, EIOPA and ESMA are collectively referred to as European Supervisory Authorities (ESAs)*
Competent authorities (Article 46)
- To achieve a high common level of digital operational resilience by harmonising the security of network and information systems requirements for financial entities (Article 1).
- Financial entities, including credit, payment and e-money institutions, investment firms, crypto-asset service providers, issuers of crypto-assets, insurance and reinsurance undertakings, credit rating agencies, statutory auditors and audit firms and crowdfunding service providers (Article 3)
ICT risk management and governance (Chapter II)
ICT-Related incidents management, classification and reporting (Chapter III)
Digital operational resilience testing (Chapter IV)
Third-party risk management (Chapter V)
DORAon StreamLex, what can I find?
Technical standards, guidance (guidelines, recommendations, etc.) and templates issued by the ESAs relevant to DORA
Legislation (decisions, implementing decisions, implementing regulation, etc.) adopted by the European Commission relevant to DORA
Relevant registers maintained by the ESAs and the European Commission relevant to DORA
ESAs and European Commission consultations, press releases, internal documents, annual reports, leaflets and similar information materials and ad hoc statements that do not constitute guidance
Draft versions of the ESAs and European Commission documents (e.g., technical standards issued for the purposes of public consultation) and invalidated documents (e.g., superseded by other documents)
Documents issued by the national competent authorities
EU and national court judgments