DORA Library

This Directive amends multiple EU financial-services directives to ensure legal clarity and consistency with the digital operational resilience requirements set out in Regulation (EU) 2022/2554 (DORA).

The primary legislative act establishing a unified framework for digital operational resilience across the EU financial sector, aiming to mitigate ICT risks and ensure continuity of critical functions.

Regulatory Technical Standards under DORA specifying detailed ICT risk management tools, methods, processes and policies, including ICT security governance, asset management, encryption, operations security, vulnerability and patch management.

Final draft Regulatory Technical Standards specifying detailed and harmonised requirements for ICT risk management frameworks under DORA, including ICT security policies, access controls, detection and response mechanisms.

Regulatory Technical Standards under DORA specifying the harmonised content and reporting timelines for initial notifications, intermediate reports, and final reports of major ICT-related incidents.

Implementing Technical Standards under Regulation (EU) 2022/2554 (DORA) specifying harmonised templates, data fields, procedures, and secure channels for financial entities to submit reports for major ICT-related incidents.

Final draft Regulatory and Implementing Technical Standards under DORA specifying harmonised requirements for reporting major ICT-related incidents and notifying significant cyber threats.

Joint Guidelines specifying methodologies and reporting templates for estimating aggregated annual costs and losses caused by major ICT-related incidents under Regulation (EU) 2022/2554.

Regulatory Technical Standards under DORA defining harmonised criteria for classifying ICT-related incidents and cyber threats, setting quantitative and qualitative materiality thresholds for determining major incidents.

Final draft Regulatory Technical Standards under DORA specifying harmonised criteria and materiality thresholds for classifying ICT-related incidents, defining major incidents, recurring incidents, and significant cyber threats.

Joint feasibility study assessing options for further centralisation of major ICT-related incident reporting under DORA, including baseline, data-sharing, and fully centralised EU Hub scenarios.

Regulatory Technical Standards under DORA establishing detailed rules for threat-led penetration testing (TLPT), including criteria for identifying entities subject to testing, governance and organisational requirements.

Guidance under the TIBER-EU framework describing requirements, selection criteria, and governance considerations for procuring Threat Intelligence Providers and Red Team Testers.

Guidance under the TIBER-EU framework describing requirements, roles, processes, and best practices for conducting purple teaming activities during threat-led penetration testing.

Operational guidance under the TIBER-EU framework describing how financial entities should establish and operate a Control Team responsible for planning, managing, and overseeing TLPT.

Final draft Regulatory Technical Standards under DORA specifying detailed requirements for threat-led penetration testing (TLPT), including criteria for identifying entities required to perform TLPT.

Supervisory guidance from the ECB setting out expectations and observed good practices for banks when outsourcing cloud services, aligned with DORA and related EU prudential requirements.

Regulatory Technical Standards under DORA specifying the elements financial entities must consider when ICT third-party service providers subcontract ICT services supporting critical or important functions.

Implementing Technical Standards under DORA specifying standard templates and completion instructions for the register of information on all contractual arrangements for ICT services.

Opinion issued by the ESAs Joint Committee following the European Commission's rejection of the draft ITS on standard templates for the DORA register of information.

Regulatory Technical Standards under DORA specifying the detailed requirements for policies governing contractual arrangements with ICT third-party service providers supporting critical or important functions.

Final Report containing draft Implementing Technical Standards under DORA specifying standard templates for the register of information on all contractual arrangements for ICT services.

Union-level list published in accordance with Article 31(9) of Regulation (EU) 2022/2554 (DORA), setting out the designated critical ICT third-party service providers (CTPPs).

Regulatory Technical Standards under DORA establishing detailed rules for joint examination teams (JETs) supporting the Lead Overseer in the oversight of critical ICT third-party service providers.

Regulatory Technical Standards under DORA that harmonise the conditions for conducting oversight of critical ICT third-party service providers.

Joint Committee Guidelines establishing a common operational approach for cooperation and information exchange between the ESAs and competent authorities for the oversight framework of critical ICT TPPs.

Regulatory Technical Standards under DORA establishing the criteria and a two-step assessment approach for designating ICT third-party service providers as critical for financial entities.

Regulatory Technical Standards under DORA setting the annual oversight fee framework for critical ICT third-party service providers (CTPPs).