The DORA Act and the DORA Regulations

Brief overview

What regulates this

Who is affected

Why it has practical significance

Key Requirements and Obligations

• Determine whether the undertaking falls within the scope of DORA Article 2, and document the assessment of any exemptions or special rules.
• The undertaking's governing body has overall responsibility for ICT risk and shall approve, monitor, and regularly review the ICT risk management framework.
• The undertaking shall have a documented framework to identify, protect, detect, manage, recover from, and learn from ICT-related risks and incidents.
• ICT systems, information values, data, critical functions, dependencies and suppliers must be identified and kept updated.
• The undertaking shall have procedures to detect, manage, classify and report ICT-related incidents.
• Serious ICT incidents must be reported to Finanstilsynet: an initial notification no later than four hours after classification and in any case no later than 24 hours after detection, the first status report no later than 72 hours after the initial notification, and the final report no later than one month after the latest status report.
• The undertaking shall implement a risk-based program for testing digital operational resilience and follow up on identified vulnerabilities.
• Enterprises designated by the supervisory authority shall conduct threat-led penetration testing in accordance with the specific TLPT rules.
• ICT third-party risk must be included in the undertaking's overall ICT risk management; the undertaking retains responsibility even when services are provided by external or intra-group suppliers.
• Before an ICT service agreement is entered into, the undertaking shall, among other things, assess risk, criticality, the supplier, concentration risk, and the possibility of an orderly exit.
• ICT service agreements must include the contract provisions required by DORA, with additional requirements when the service supports a critical or important function.
• The undertaking shall maintain and update an information register of contractual arrangements for the use of ICT services and make the register available or report it in accordance with regulatory requirements.

What the business may consider documenting

• Conduct a precise scope analysis against DORA Article 2 and document which provisions and any simplified frameworks apply.
• Map all ICT services and specifically assess whether AI, language, and cloud services are covered by the definition of an ICT service.
• Classify which functions are critical or important, and document how loss or failure will impact customers, license requirements, and continuity.
• Update the information registry when agreements, services, suppliers, or subcontractors change.
• Review the ICT contracts against the requirements in DORA Article 30, including requirements for service levels, security, incident assistance, access and audit, regulatory cooperation, termination, and exit.
• Assess the geographical location of data and processing, use of subcontractors, vendor concentration, and the possibility of moving or restoring the service.
• Test preparedness, backup, recovery, and exit plans together with relevant vendors.
• Establish an incident procedure that enables the classification of an incident and compliance with the four-hour, 24-hour, 72-hour, and one-month deadlines.
• Ensure that the board of directors and relevant employees have sufficient knowledge and regular training on ICT risk and digital operational resilience.
• Coordinate the DORA work with data privacy, AI regulations, and other financial regulatory requirements without merging different notification obligations or assessment themes.