icon-grid
Better Regulation logo
Table of Contents

Table of Contents

Expand all headings Collapse all headings Expand side bar Collapse side bar
Regulation (EU) 2022/2554 of the European Parliament and of the Council of 14 December 2022 on digital operational resilience for the financial sector and amending Regulations (EC) No 1060/2009, (EU) No 648/2012, (EU) No 600/2014, (EU) No 909/2014 and (EU) 2016/1011 (Text with EEA relevance) (Digital Operational Resilience Act (DORA) / Regulation on digital operational resilience for the financial sector)RecitalsChapter I General provisions (arts. 1-4)Article 1 Subject matterArticle 2 ScopeArticle 3 DefinitionsArticle 4 Proportionality principleChapter II ICT risk management (arts. 5-16)Section I (art. 5)Article 5 Governance and organisationSection II (arts. 6-16)Article 6 ICT risk management frameworkArticle 7 ICT systems, protocols and toolsArticle 8 IdentificationArticle 9 Protection and preventionArticle 10 DetectionArticle 11 Response and recoveryArticle 12 Backup policies and procedures, restoration and recovery procedures and methodsArticle 13 Learning and evolvingArticle 14 CommunicationArticle 15 Further harmonisation of ICT risk management tools, methods, processes and policiesArticle 16 Simplified ICT risk management frameworkChapter III ICT-related incident management, classification and reporting (arts. 17-23)Article 17 ICT-related incident management processArticle 18 Classification of ICT-related incidents and cyber threatsArticle 19 Reporting of major ICT-related incidents and voluntary notification of significant cyber threatsArticle 20 Harmonisation of reporting content and templatesArticle 21 Centralisation of reporting of major ICT-related incidentsArticle 22 Supervisory feedbackArticle 23 Operational or security payment-related incidents concerning credit institutions, payment institutions, account information service providers, and electronic money institutionsChapter IV Digital operational resilience testing (arts. 24-27)Article 24 General requirements for the performance of digital operational resilience testingArticle 25 Testing of ICT tools and systemsArticle 26 Advanced testing of ICT tools, systems and processes based on TLPTArticle 27 Requirements for testers for the carrying out of TLPTChapter V Managing of ICT third-party risk (arts. 28-44)Section I Key principles for a sound management of ICT third-party risk (arts. 28-30)Article 28 General principlesArticle 29 Preliminary assessment of ICT concentration risk at entity levelArticle 30 Key contractual provisionsSection II Oversight Framework of critical ICT third-party service providers (arts. 31-44)Article 31 Designation of critical ICT third-party service providersArticle 32 Structure of the Oversight FrameworkArticle 33 Tasks of the Lead OverseerArticle 34 Operational coordination between Lead OverseersArticle 35 Powers of the Lead OverseerArticle 36 Exercise of the powers of the Lead Overseer outside the UnionArticle 37 Request for informationArticle 38 General investigationsArticle 39 InspectionsArticle 40 Ongoing oversightArticle 41 Harmonisation of conditions enabling the conduct of the oversight activitiesArticle 42 Follow-up by competent authoritiesArticle 43 Oversight feesArticle 44 International cooperationChapter VI Information-sharing arrangements (art. 45)Article 45 Information-sharing arrangements on cyber threat information and intelligenceChapter VII Competent authorities (arts. 46-56)Article 46 Competent authoritiesArticle 47 Cooperation with structures and authorities established by Directive (EU) 2022/2555Article 48 Cooperation between authoritiesArticle 49 Financial cross-sector exercises, communication and cooperationArticle 50 Administrative penalties and remedial measuresArticle 51 Exercise of the power to impose administrative penalties and remedial measuresArticle 52 Criminal penaltiesArticle 53 Notification dutiesArticle 54 Publication of administrative penaltiesArticle 55 Professional secrecyArticle 56 Data ProtectionChapter VIII Delegated acts (art. 57)Article 57 Exercise of the delegationChapter IX Transitional and final provisions (arts. 58-64)Section I (art. 58)Article 58 Review clauseSection II  Amendments (arts. 59-64)Article 59 Amendments to Regulation (EC) No 1060/2009Article 60 Amendments to Regulation (EU) No 648/2012Article 61 Amendments to Regulation (EU) No 909/2014Article 62 Amendments to Regulation (EU) No 600/2014Article 63 Amendment to Regulation (EU) 2016/1011Article 64 Entry into force and applicationDone at
Page Overview
Related
Tools
Set a date to view the document
Text comparison options
Full text - Date 1 vs Date 2 
Amendments requiring commencement - Current text vs Text requiring commencement
Draft proposed changes - Current text vs Text proposed by drafting documents
Recently generated comparisons
None generated
Print / Export options
Current page
Whole document
Selected pages
Consolidated PDF of the entire document as of 20th April 2026
Export
Export line by line
Export provision to provision
Report template
Create report template
Alert me to changes
Manage alerts
Bookmarks
This page
This document
Manage bookmarks
Search within this document
View previous searches
Share
Get page link
Share via email application

AI Summary of Article 4 Proportionality principle

Financial entities are mandated to implement the rules stipulated in Chapter II with due regard to the principle of proportionality. This means they must assess their size, overall risk profile, and the nature, scale, and complexity of their services, activities, and operations.

Furthermore, the proportionality principle shall also guide the application of Chapters III, IV, and V, Section I, ensuring that assessments align with the specific provisions of these Chapters. Competent authorities will scrutinise the adherence to this principle during their review of the ICT risk management frameworks, relying on reports submitted as per Article 6(5) and Article 16(2).

PreviousNext
Version status: Applicable | Document consolidation status: No known changes
Version date: 17 January 2025 - onwards
Version 3 of 3

Article 4 Proportionality principle

1. Financial entities shall implement the rules laid down in Chapter II in accordance with the principle of proportionality, taking into account their size and overall risk profile, and the nature, scale and complexity of their services, activities and operations.

2. In addition, the application by financial entities of Chapters III, IV and V, Section I, shall be proportionate to their size and overall risk profile, and to the nature, scale and complexity of their services, activities and operations, as specifically provided for in the relevant rules of those Chapters.

3. The competent authorities shall consider the application of the proportionality principle by financial entities when reviewing the consistency of the ICT risk management framework on the basis of the reports submitted upon the request of competent authorities pursuant to Article 6(5) and Article 16(2).

PreviousNext