Better Regulation logo
Table of Contents

Table of Contents

Expand all headings Collapse all headings Expand side bar Collapse side bar
Regulation (EU) 2022/2554 of the European Parliament and of the Council of 14 December 2022 on digital operational resilience for the financial sector and amending Regulations (EC) No 1060/2009, (EU) No 648/2012, (EU) No 600/2014, (EU) No 909/2014 and (EU) 2016/1011 (Text with EEA relevance) (Digital Operational Resilience Act (DORA) / Regulation on digital operational resilience for the financial sector)RecitalsChapter I General provisions (arts. 1-4)Article 1 Subject matterArticle 2 ScopeArticle 3 DefinitionsArticle 4 Proportionality principleChapter II ICT risk management (arts. 5-16)Section I (art. 5)Article 5 Governance and organisationSection II (arts. 6-16)Article 6 ICT risk management frameworkArticle 7 ICT systems, protocols and toolsArticle 8 IdentificationArticle 9 Protection and preventionArticle 10 DetectionArticle 11 Response and recoveryArticle 12 Backup policies and procedures, restoration and recovery procedures and methodsArticle 13 Learning and evolvingArticle 14 CommunicationArticle 15 Further harmonisation of ICT risk management tools, methods, processes and policiesArticle 16 Simplified ICT risk management frameworkChapter III ICT-related incident management, classification and reporting (arts. 17-23)Article 17 ICT-related incident management processArticle 18 Classification of ICT-related incidents and cyber threatsArticle 19 Reporting of major ICT-related incidents and voluntary notification of significant cyber threatsArticle 20 Harmonisation of reporting content and templatesArticle 21 Centralisation of reporting of major ICT-related incidentsArticle 22 Supervisory feedbackArticle 23 Operational or security payment-related incidents concerning credit institutions, payment institutions, account information service providers, and electronic money institutionsChapter IV Digital operational resilience testing (arts. 24-27)Article 24 General requirements for the performance of digital operational resilience testingArticle 25 Testing of ICT tools and systemsArticle 26 Advanced testing of ICT tools, systems and processes based on TLPTArticle 27 Requirements for testers for the carrying out of TLPTChapter V Managing of ICT third-party risk (arts. 28-44)Section I Key principles for a sound management of ICT third-party risk (arts. 28-30)Article 28 General principlesArticle 29 Preliminary assessment of ICT concentration risk at entity levelArticle 30 Key contractual provisionsSection II Oversight Framework of critical ICT third-party service providers (arts. 31-44)Article 31 Designation of critical ICT third-party service providersArticle 32 Structure of the Oversight FrameworkArticle 33 Tasks of the Lead OverseerArticle 34 Operational coordination between Lead OverseersArticle 35 Powers of the Lead OverseerArticle 36 Exercise of the powers of the Lead Overseer outside the UnionArticle 37 Request for informationArticle 38 General investigationsArticle 39 InspectionsArticle 40 Ongoing oversightArticle 41 Harmonisation of conditions enabling the conduct of the oversight activitiesArticle 42 Follow-up by competent authoritiesArticle 43 Oversight feesArticle 44 International cooperationChapter VI Information-sharing arrangements (art. 45)Article 45 Information-sharing arrangements on cyber threat information and intelligenceChapter VII Competent authorities (arts. 46-56)Article 46 Competent authoritiesArticle 47 Cooperation with structures and authorities established by Directive (EU) 2022/2555Article 48 Cooperation between authoritiesArticle 49 Financial cross-sector exercises, communication and cooperationArticle 50 Administrative penalties and remedial measuresArticle 51 Exercise of the power to impose administrative penalties and remedial measuresArticle 52 Criminal penaltiesArticle 53 Notification dutiesArticle 54 Publication of administrative penaltiesArticle 55 Professional secrecyArticle 56 Data ProtectionChapter VIII Delegated acts (art. 57)Article 57 Exercise of the delegationChapter IX Transitional and final provisions (arts. 58-64)Section I (art. 58)Article 58 Review clauseSection II  Amendments (arts. 59-64)Article 59 Amendments to Regulation (EC) No 1060/2009Article 60 Amendments to Regulation (EU) No 648/2012Article 61 Amendments to Regulation (EU) No 909/2014Article 62 Amendments to Regulation (EU) No 600/2014Article 63 Amendment to Regulation (EU) 2016/1011Article 64 Entry into force and applicationDone at
Page Overview
Tools
Set a date to view the document
Text comparison options
Full text - Date 1 vs Date 2 
Amendments requiring commencement - Current text vs Text requiring commencement
Draft proposed changes - Current text vs Text proposed by drafting documents
Recently generated comparisons
None generated
Print / Export options
Current page
Whole document
Selected pages
Consolidated PDF of the entire document as of 16th June 2026
Export
Export line by line
Export provision to provision
Report template
Create report template
Alert me to changes
Manage alerts
Bookmarks
This page
This document
Manage bookmarks
Search within this document
View previous searches
Share
Get page link
Share via email application

AI Summary of Article 24 General requirements for the performance of digital operational resilience testing

PreviousNext
Version status: Applicable | Document consolidation status: No known changes
Version date: 17 January 2025 - onwards
Version 3 of 3

Article 24 General requirements for the performance of digital operational resilience testing

1. For the purpose of assessing preparedness for handling ICT-related incidents, of identifying weaknesses, deficiencies and gaps in digital operational resilience, and of promptly implementing corrective measures, financial entities, other than microenterprises, shall, taking into account the criteria set out in Article 4(2), establish, maintain and review a sound and comprehensive digital operational resilience testing programme as an integral part of the ICT risk-management framework referred to in Article 6.

2. The digital operational resilience testing programme shall include a range of assessments, tests, methodologies, practices and tools to be applied in accordance with Articles 25 and 26.

3. When conducting the digital operational resilience testing programme referred to in paragraph 1 of this Article, financial entities, other than microenterprises, shall follow a risk-based approach taking into account the criteria set out in Article 4(2) duly considering the evolving landscape of ICT risk, any specific risks to which the financial entity concerned is or might be exposed, the criticality of information assets and of services provided, as well as any other factor the financial entity deems appropriate.

PreviousNext