icon-grid
Better Regulation logo
Table of Contents

Table of Contents

Expand all headings Collapse all headings Expand side bar Collapse side bar
Regulation (EU) 2022/2554 of the European Parliament and of the Council of 14 December 2022 on digital operational resilience for the financial sector and amending Regulations (EC) No 1060/2009, (EU) No 648/2012, (EU) No 600/2014, (EU) No 909/2014 and (EU) 2016/1011 (Text with EEA relevance) (Digital Operational Resilience Act (DORA) / Regulation on digital operational resilience for the financial sector)RecitalsChapter I General provisions (arts. 1-4)Article 1 Subject matterArticle 2 ScopeArticle 3 DefinitionsArticle 4 Proportionality principleChapter II ICT risk management (arts. 5-16)Section I (art. 5)Article 5 Governance and organisationSection II (arts. 6-16)Article 6 ICT risk management frameworkArticle 7 ICT systems, protocols and toolsArticle 8 IdentificationArticle 9 Protection and preventionArticle 10 DetectionArticle 11 Response and recoveryArticle 12 Backup policies and procedures, restoration and recovery procedures and methodsArticle 13 Learning and evolvingArticle 14 CommunicationArticle 15 Further harmonisation of ICT risk management tools, methods, processes and policiesArticle 16 Simplified ICT risk management frameworkChapter III ICT-related incident management, classification and reporting (arts. 17-23)Article 17 ICT-related incident management processArticle 18 Classification of ICT-related incidents and cyber threatsArticle 19 Reporting of major ICT-related incidents and voluntary notification of significant cyber threatsArticle 20 Harmonisation of reporting content and templatesArticle 21 Centralisation of reporting of major ICT-related incidentsArticle 22 Supervisory feedbackArticle 23 Operational or security payment-related incidents concerning credit institutions, payment institutions, account information service providers, and electronic money institutionsChapter IV Digital operational resilience testing (arts. 24-27)Article 24 General requirements for the performance of digital operational resilience testingArticle 25 Testing of ICT tools and systemsArticle 26 Advanced testing of ICT tools, systems and processes based on TLPTArticle 27 Requirements for testers for the carrying out of TLPTChapter V Managing of ICT third-party risk (arts. 28-44)Section I Key principles for a sound management of ICT third-party risk (arts. 28-30)Article 28 General principlesArticle 29 Preliminary assessment of ICT concentration risk at entity levelArticle 30 Key contractual provisionsSection II Oversight Framework of critical ICT third-party service providers (arts. 31-44)Article 31 Designation of critical ICT third-party service providersArticle 32 Structure of the Oversight FrameworkArticle 33 Tasks of the Lead OverseerArticle 34 Operational coordination between Lead OverseersArticle 35 Powers of the Lead OverseerArticle 36 Exercise of the powers of the Lead Overseer outside the UnionArticle 37 Request for informationArticle 38 General investigationsArticle 39 InspectionsArticle 40 Ongoing oversightArticle 41 Harmonisation of conditions enabling the conduct of the oversight activitiesArticle 42 Follow-up by competent authoritiesArticle 43 Oversight feesArticle 44 International cooperationChapter VI Information-sharing arrangements (art. 45)Article 45 Information-sharing arrangements on cyber threat information and intelligenceChapter VII Competent authorities (arts. 46-56)Article 46 Competent authoritiesArticle 47 Cooperation with structures and authorities established by Directive (EU) 2022/2555Article 48 Cooperation between authoritiesArticle 49 Financial cross-sector exercises, communication and cooperationArticle 50 Administrative penalties and remedial measuresArticle 51 Exercise of the power to impose administrative penalties and remedial measuresArticle 52 Criminal penaltiesArticle 53 Notification dutiesArticle 54 Publication of administrative penaltiesArticle 55 Professional secrecyArticle 56 Data ProtectionChapter VIII Delegated acts (art. 57)Article 57 Exercise of the delegationChapter IX Transitional and final provisions (arts. 58-64)Section I (art. 58)Article 58 Review clauseSection II  Amendments (arts. 59-64)Article 59 Amendments to Regulation (EC) No 1060/2009Article 60 Amendments to Regulation (EU) No 648/2012Article 61 Amendments to Regulation (EU) No 909/2014Article 62 Amendments to Regulation (EU) No 600/2014Article 63 Amendment to Regulation (EU) 2016/1011Article 64 Entry into force and applicationDone at
Tools
Set a date to view the document
Text comparison options
Full text - Date 1 vs Date 2 
Amendments requiring commencement - Current text vs Text requiring commencement
Draft proposed changes - Current text vs Text proposed by drafting documents
Recently generated comparisons
None generated
Print / Export options
Current page
Whole document
Selected pages
Consolidated PDF of the entire document as of 20th April 2026
Export
Export line by line
Export provision to provision
Report template
Create report template
Alert me to changes
Manage alerts
Bookmarks
This page
This document
Manage bookmarks
Search within this document
View previous searches
Share
Get page link
Share via email application

AI Summary of Chapter II ICT risk management (arts. 5-16)

PreviousNext
Version status: | Document consolidation status: No known changes
Version date: 27 December 2022 - onwards

Chapter II ICT risk management (arts. 5-16)

Future version Draft proposed change
Section I (art. 5)
Article 5 Governance and organisation
Section II (arts. 6-16)
Article 6 ICT risk management framework
Article 7 ICT systems, protocols and tools
Article 8 Identification
Article 9 Protection and prevention
Article 10 Detection
Article 11 Response and recovery
Article 12 Backup policies and procedures, restoration and recovery procedures and methods
Article 13 Learning and evolving
Article 14 Communication
Article 15 Further harmonisation of ICT risk management tools, methods, processes and policies
Article 16 Simplified ICT risk management framework
PreviousNext