DORA Applicability and Governance — Articles 1, 2, 4, 5, 6, 16

Regulation (EU) 2022/2554 (DORA) has rules that tell a financial entity if DORA applies to it, and which ICT risk management regime it must apply. These rules are in Chapter I (Articles 1 to 4) and in Articles 5, 6 and 16 of Chapter II. The obligations of Articles 4(1), 5, 6, 16(1) and 16(2) are on the financial entity and on its management body.

Article 1 — Subject matter

DORA Article 1(1) gives the subject matter of DORA. DORA "lays down uniform requirements concerning the security of network and information systems supporting the business processes of financial entities". DORA does this "In order to achieve a high common level of digital operational resilience". Article 1(1) has four points:

• Article 1(1)(a) — requirements for financial entities about:
  • ICT risk management
  • reporting of major ICT-related incidents, and "notifying, on a voluntary basis, significant cyber threats" to the competent authorities
  • reporting of major operational or security payment-related incidents to the competent authorities, by the financial entities of Article 2(1), points (a) to (d)
  • digital operational resilience testing
  • information and intelligence sharing about cyber threats and vulnerabilities
  • "measures for the sound management of ICT third-party risk"
• Article 1(1)(b) — requirements for the contractual arrangements between ICT third-party service providers and financial entities.
• Article 1(1)(c) — rules for the Oversight Framework for critical ICT third-party service providers "when providing services to financial entities".
• Article 1(1)(d) — "rules on cooperation among competent authorities, and rules on supervision and enforcement by competent authorities in relation to all matters covered by this Regulation".

Thus, financial entities, and not ICT third-party service providers, have the obligations of point (a) about ICT third-party risk. Article 1(3): "This Regulation is without prejudice to the responsibility of Member States’ regarding essential State functions concerning public security, defence and national security in accordance with Union law."

Article 1(2) — DORA and NIS2

DORA Article 1(2) applies to financial entities that are identified as essential or important entities "pursuant to national rules transposing Article 3 of Directive (EU) 2022/2555" (NIS2). For these financial entities, DORA "shall be considered a sector-specific Union legal act for the purposes of Article 4" of NIS2.

NIS2 Article 4(1) gives the effect. A sector-specific Union legal act can tell essential or important entities "to adopt cybersecurity risk-management measures or to notify significant incidents". If these requirements are "at least equivalent in effect to the obligations laid down in this Directive", the "relevant provisions" of NIS2 do not apply to these entities. These provisions include "the provisions on supervision and enforcement laid down in Chapter VII". NIS2 Article 4(1), second sentence, adds this rule: "Where sector-specific Union legal acts do not cover all entities in a specific sector falling within the scope of this Directive, the relevant provisions of this Directive shall continue to apply to the entities not covered by those sector-specific Union legal acts".

NIS2 Article 4(2) gives the test. The requirements are equivalent in effect if one of these conditions applies:

• NIS2 Article 4(2)(a) — the cybersecurity risk-management measures are "at least equivalent in effect to those laid down in Article 21(1) and (2)" of NIS2.
• NIS2 Article 4(2)(b) — the sector-specific Union legal act gives the CSIRTs, the competent authorities or the single points of contact of NIS2 "immediate access, where appropriate automatic and direct, to the incident notifications". Also, its notification requirements are "at least equivalent in effect to those laid down in Article 23(1) to (6)" of NIS2.

DORA Article 19(1) lets Member States tell financial entities to send incident reports also to NIS2 competent authorities or CSIRTs. For these incident reports, see Reports to NIS2 authorities. To compare DORA with NIS2 and with the EU AI Act, see NIS2 and DORA and EU AI Act and DORA.

Article 2 — Scope

DORA Article 2 gives the entities that DORA applies to. Article 2(1) gives 21 types of entities. Article 2(3) excludes six types of entities. Article 2(4) lets each Member State exclude more entities. Article 2(1) applies "without prejudice to paragraphs 3 and 4".

Article 2(1), point (u), also includes ICT third-party service providers.

Article 2(1) — financial entities in scope

DORA Article 2(1), points (a) to (t), applies DORA to these 20 types of financial entities:

• (a) credit institutions
• (b) payment institutions, and also "payment institutions exempted pursuant to Directive (EU) 2015/2366"
• (c) account information service providers
• (d) electronic money institutions, and also "electronic money institutions exempted pursuant to Directive 2009/110/EC"
• (e) investment firms
• (f) crypto-asset service providers "as authorised under" "the Regulation on markets in crypto-assets", and issuers of asset-referenced tokens
• (g) central securities depositories
• (h) central counterparties
• (i) trading venues
• (j) trade repositories
• (k) managers of alternative investment funds
• (l) management companies
• (m) data reporting service providers
• (n) insurance and reinsurance undertakings
• (o) "insurance intermediaries, reinsurance intermediaries and ancillary insurance intermediaries"
• (p) institutions for occupational retirement provision
• (q) credit rating agencies
• (r) administrators of critical benchmarks
• (s) crowdfunding service providers
• (t) “securitisation repositories”

In Article 2(2), the entities of points (a) to (t) are the "financial entities". An ICT third-party service provider is in scope through point (u). It is also a financial entity if points (a) to (t) apply to it (Article 2(2)). See the obligations of financial entities, contract provisions, and Oversight Framework for designated critical ICT third-party service providers.

Article 2(3) — entities that DORA does not apply to

DORA Article 2(3) excludes these six types of entities:

• (a) managers of alternative investment funds "as referred to in Article 3(2) of Directive 2011/61/EU"
• (b) insurance and reinsurance undertakings "as referred to in Article 4 of Directive 2009/138/EC"
• (c) institutions for occupational retirement provision "which operate pension schemes which together do not have more than 15 members in total"
• (d) natural or legal persons "exempted pursuant to Articles 2 and 3 of Directive 2014/65/EU"
• (e) "insurance intermediaries, reinsurance intermediaries and ancillary insurance intermediaries" that are microenterprises or small or medium-sized enterprises
• (f) post office giro institutions "as referred to in Article 2(5), point (3), of Directive 2013/36/EU"

Article 2(3) excludes no other entity. An institution for occupational retirement provision with pension schemes that together have "more than 15 members" is in scope. If its pension schemes together have "less than 100 members", it is a small institution for occupational retirement provision (Article 3(53)). This institution applies the simplified ICT risk management framework of Article 16.

Article 2(4) — entities that a Member State can exclude

DORA Article 2(4) lets each Member State exclude the entities of Article 2(5), points (4) to (23), of Directive 2013/36/EU "that are located within their respective territories". A Member State that excludes these entities must tell the Commission about this decision and all subsequent changes to it. The Commission must "make that information publicly available". NIS2 does not apply to these excluded entities (NIS2 Article 2(10)).

An institution that is "exempted pursuant to Directive 2013/36/EU" is in scope if its Member State "decided not to apply the option referred to in Article 2(4)". This institution is one of the entities in Article 16(1), and the simplified ICT risk management framework applies to it.

Scope conditions

DORA Article 2(1) gives types of entities. Some other provisions use the number of persons or "annual turnover and/or annual balance sheet total":

• Article 2(3), point (c), excludes institutions for occupational retirement provision "which operate pension schemes which together do not have more than 15 members in total".
• Article 2(3), point (e), excludes "insurance intermediaries, reinsurance intermediaries and ancillary insurance intermediaries" that are microenterprises or small or medium-sized enterprises.
• Article 16(1) puts small and non-interconnected investment firms and small institutions for occupational retirement provision in the simplified ICT risk management framework.
• Many paragraphs do not apply to microenterprises (see Article 3).

NIS2 Article 2(1) applies to entities of a type in its Annex I or II that "qualify as medium-sized enterprises" or "exceed the ceilings for medium-sized enterprises". NIS2 Article 2(2) to (4) add entities "regardless of their size".

Article 3 — Definitions

Financial entities use these DORA Article 3 definitions to assess scope and governance obligations:

Name	Point	Definition
ICT third-party service provider	(19)	"an undertaking providing ICT services"
ICT services	(21)	"digital and data services provided through ICT systems to one or more internal or external users on an ongoing basis, including hardware as a service and hardware services which includes the provision of technical support via software or firmware updates by the hardware provider, excluding traditional analogue telephone services"
critical or important function	(22)	"a function, the disruption of which would materially impair the financial performance of a financial entity, or the soundness or continuity of its services and activities, or the discontinued, defective or failed performance of that function would materially impair the continuing compliance of a financial entity with the conditions and obligations of its authorisation, or with its other obligations under applicable financial services law"
critical ICT third-party service provider	(23)	"an ICT third-party service provider designated as critical in accordance with Article 31"
management body	(30)	A "management body as defined in" the Directives and Regulations that Article 3(30) gives, "or the equivalent persons who effectively run the entity or have key functions in accordance with relevant Union or national law"
small and non-interconnected investment firm	(34)	"an investment firm that meets the conditions laid out in Article 12(1) of Regulation (EU) 2019/2033"
small institution for occupational retirement provision	(53)	"an institution for occupational retirement provision which operates pension schemes which together have less than 100 members in total"
microenterprise	(60)	"a financial entity, other than a trading venue, a central counterparty, a trade repository or a central securities depository, which employs fewer than 10 persons and has an annual turnover and/or annual balance sheet total that does not exceed EUR 2 million"
Lead Overseer	(61)	"the European Supervisory Authority appointed in accordance with Article 31(1), point (b) of this Regulation"
Joint Committee	(62)	"the committee referred to in Article 54 of Regulations (EU) No 1093/2010, (EU) No 1094/2010 and (EU) No 1095/2010"

For threat-led penetration testing (Article 3(17)), see Articles 26 and 27. For operational or security payment-related incidents (Article 3(9)), see Article 23.

The microenterprise test is different from the test of Article 16(1). These provisions apply to financial entities "other than microenterprises":

• Article 5(3)
• the first sentence of Article 6(4)
• Articles 6(6), 8(3), 8(7) and 11(7)
• the first sentence of Article 12(4)
• Articles 13(7) and 24(1)

Articles 26(1) and 28(2) exclude microenterprises and also the entities in Article 16(1). Thus, a microenterprise that is not in Article 16(1) applies the full regime, but these provisions do not apply to it. In Article 12(4), this microenterprise must assess if its "risk profile" makes it necessary to keep redundant ICT capacities (see Article 12).

Article 4 — Proportionality principle

DORA Article 4(1) applies the principle of proportionality to Chapter II:

Financial entities shall implement the rules laid down in Chapter II in accordance with the principle of proportionality, taking into account their size and overall risk profile, and the nature, scale and complexity of their services, activities and operations.

Article 4(2) applies proportionality to Chapters III, IV and V, Section I, but only "as specifically provided for in the relevant rules of those Chapters". In Article 4(3), the competent authorities "consider the application of the proportionality principle by financial entities" when they review "the consistency of the ICT risk management framework". For this review, they use the reports of Articles 6(5) and 16(2), which financial entities send "upon the request of competent authorities".

Proportionality changes how a financial entity applies a rule. Proportionality does not remove an obligation.

Article 5 — management body governance

DORA Article 5 applies to financial entities in the full regime (Articles 5 to 15). In Article 5(1), each of these financial entities must have an internal governance and control framework "that ensures an effective and prudent management of ICT risk, in accordance with Article 6(4)".

In Article 5(2), the management body of the financial entity "shall define, approve, oversee and be responsible for the implementation of all arrangements related to the ICT risk management framework referred to in Article 6(1)". Article 5(2), second subparagraph, then gives the management body nine obligations:

(a) bear the ultimate responsibility for managing the financial entity’s ICT risk;

(b) put in place policies that aim to ensure the maintenance of high standards of availability, authenticity, integrity and confidentiality, of data;

(c) set clear roles and responsibilities for all ICT-related functions and establish appropriate governance arrangements to ensure effective and timely communication, cooperation and coordination among those functions;

(d) bear the overall responsibility for setting and approving the digital operational resilience strategy as referred to in Article 6(8), including the determination of the appropriate risk tolerance level of ICT risk of the financial entity, as referred to in Article 6(8), point (b);

(e) approve, oversee and periodically review the implementation of the financial entity’s ICT business continuity policy and ICT response and recovery plans, referred to, respectively, in Article 11(1) and (3), which may be adopted as a dedicated specific policy forming an integral part of the financial entity’s overall business continuity policy and response and recovery plan;

(f) approve and periodically review the financial entity’s ICT internal audit plans, ICT audits and material modifications to them;

(g) allocate and periodically review the appropriate budget to fulfil the financial entity’s digital operational resilience needs in respect of all types of resources, including relevant ICT security awareness programmes and digital operational resilience training referred to in Article 13(6), and ICT skills for all staff;

(h) approve and periodically review the financial entity’s policy on arrangements regarding the use of ICT services provided by ICT third-party service providers;

(i) put in place, at corporate level, reporting channels enabling it to be duly informed of the following: (i) arrangements concluded with ICT third-party service providers on the use of ICT services, (ii) any relevant planned material changes regarding the ICT third-party service providers, (iii) the potential impact of such changes on the critical or important functions subject to those arrangements, including a risk analysis summary to assess the impact of those changes, and at least major ICT-related incidents and their impact, as well as response, recovery and corrective measures.

For the strategy on ICT third-party risk and its policy, see Article 28(2).

In Article 5(3), each financial entity, other than a microenterprise, has one of these two obligations:

• "establish a role in order to monitor the arrangements concluded with ICT third-party service providers on the use of ICT services"
• "designate a member of senior management as responsible for overseeing the related risk exposure and relevant documentation"

In Article 5(4), "Members of the management body of the financial entity" must "actively keep up to date with sufficient knowledge and skills to understand and assess ICT risk and its impact on the operations of the financial entity". This includes "specific training on a regular basis, commensurate to the ICT risk being managed".

Article 5 does not apply to the entities in Article 16(1). Article 16(1) tells these entities that "Articles 5 to 15 of this Regulation shall not apply" to them. Recital 43 tells financial entities in Article 16(1) that they "should not be required to establish a role to monitor their arrangements". For these entities, the governance obligations come from Article 16(1), second subparagraph, and from Article 28 of Delegated Regulation (EU) 2024/1774.

Article 6 — ICT risk management framework

DORA Article 6 applies to financial entities in the full regime. Article 6(1) gives the basic obligation:

Financial entities shall have a sound, comprehensive and well-documented ICT risk management framework as part of their overall risk management system, which enables them to address ICT risk quickly, efficiently and comprehensively and to ensure a high level of digital operational resilience.

The other paragraphs of Article 6 give these rules:

• Article 6(2) — the framework includes, as a minimum, "strategies, policies, procedures, ICT protocols and tools" "that are necessary to duly and adequately protect all information assets and ICT assets". These also give protection to "all relevant physical components and infrastructures, such as premises, data centres and sensitive designated areas".
• Article 6(3) — the financial entity must "minimise the impact of ICT risk" with these "strategies, policies, procedures, ICT protocols and tools". The financial entity must give the competent authorities "complete and updated information on ICT risk and on their ICT risk management framework", "upon their request".
• Article 6(4), first sentence — each financial entity, other than a microenterprise, must give a control function "the responsibility for managing and overseeing ICT risk". The financial entity must make sure that this control function has "an appropriate level of independence" "in order to avoid conflicts of interest".
• Article 6(4), second sentence — all financial entities must make sure of "appropriate segregation and independence of ICT risk management functions, control functions, and internal audit functions, according to the three lines of defence model, or an internal risk management and control model".
• Article 6(5) — the financial entity must record the framework. The financial entity must review it "at least once a year", or "periodically in the case of microenterprises". All financial entities must also review the framework after major ICT-related incidents and "following supervisory instructions or conclusions derived from relevant digital operational resilience testing or audit processes". The framework "shall be continuously improved". The financial entity must send a report on the review to the competent authority "upon its request".
• Article 6(6) — for each financial entity, other than a microenterprise, the framework is "subject to internal audit by auditors on a regular basis in line with the financial entities’ audit plan". These auditors must have "sufficient knowledge, skills and expertise in ICT risk, as well as appropriate independence". "The frequency and focus of ICT audits shall be commensurate to the ICT risk of the financial entity."
• Article 6(7) — "Based on the conclusions from the internal audit review", all financial entities must "establish a formal follow-up process, including rules for the timely verification and remediation of critical ICT audit findings".
• Article 6(8) — the framework includes a digital operational resilience strategy "setting out how the framework shall be implemented". Article 6(8), points (a) to (h), give its contents. For example, it sets the risk tolerance level for ICT risk (point (b)). It also includes "implementing digital operational resilience testing, in accordance with Chapter IV of this Regulation" (point (g)).
• Article 6(9) — financial entities "may", as part of the digital operational resilience strategy of Article 6(8), "define a holistic ICT multi-vendor strategy, at group or entity level".
• Article 6(10) — financial entities "may", "in accordance with Union and national sectoral law, outsource the tasks of verifying compliance with ICT risk management requirements to intra-group or external undertakings". The financial entity "remains fully responsible for the verification of compliance with the ICT risk management requirements".

Title II of Delegated Regulation (EU) 2024/1774 gives the regulatory technical standards of Article 15 of DORA for the full regime. These include "vulnerability management procedures" (Article 10), "ICT change management" (Article 17), and a "physical and environmental security policy" (Article 18).

Title II has five chapters: "ICT Security policies, procedures, protocols, and tools", "Human resources policy and access control", "ICT-related incident detection and response", "ICT business continuity management", and the "Report on the ICT risk management framework review". For Article 15, see Articles 15 and 16(3). Articles 7 to 14 of DORA give more parts of the framework. For these Articles, see Articles 7 to 14.

Two alternative regimes

DORA has two alternative regimes for ICT risk management:

• the full regime: the ICT risk management framework of Article 6(1), with the obligations of Articles 5 to 15
• the simplified ICT risk management framework of Article 16

Article 16(1) applies directly to its entities. An entity does not select its regime. If an entity is in Article 16(1), Articles 5 to 15 do not apply to it.

Article 16 — simplified ICT risk management framework

For these entities, Articles 5 to 15 do not apply (DORA Article 16(1), first subparagraph):

• small and non-interconnected investment firms
• "payment institutions exempted pursuant to Directive (EU) 2015/2366"
• "institutions exempted pursuant to Directive 2013/36/EU in respect of which Member States have decided not to apply the option referred to in Article 2(4)" of DORA
• "electronic money institutions exempted pursuant to Directive 2009/110/EC"
• small institutions for occupational retirement provision

No other entity is in Article 16(1). Thus, the simplified ICT risk management framework is not a general rule for small and medium-sized enterprises.

Article 16(1), second subparagraph, gives these entities eight obligations, "Without prejudice to the first subparagraph":

(a) put in place and maintain a sound and documented ICT risk management framework that details the mechanisms and measures aimed at a quick, efficient and comprehensive management of ICT risk, including for the protection of relevant physical components and infrastructures;

(b) continuously monitor the security and functioning of all ICT systems;

(c) minimise the impact of ICT risk through the use of sound, resilient and updated ICT systems, protocols and tools which are appropriate to support the performance of their activities and the provision of services and adequately protect availability, authenticity, integrity and confidentiality of data in the network and information systems;

(d) allow sources of ICT risk and anomalies in the network and information systems to be promptly identified and detected and ICT-related incidents to be swiftly handled;

(e) identify key dependencies on ICT third-party service providers;

(f) ensure the continuity of critical or important functions, through business continuity plans and response and recovery measures, which include, at least, back-up and restoration measures;

(g) test, on a regular basis, the plans and measures referred to in point (f), as well as the effectiveness of the controls implemented in accordance with points (a) and (c);

(h) implement, as appropriate, relevant operational conclusions resulting from the tests referred to in point (g) and from post-incident analysis into the ICT risk assessment process and develop, according to needs and ICT risk profile, ICT security awareness programmes and digital operational resilience training for staff and management.

In Article 16(2), each of these entities must record the simplified ICT risk management framework. The entity must review the framework "periodically and upon the occurrence of major ICT-related incidents in compliance with supervisory instructions". The framework "shall be continuously improved". The entity must send a report on the review to the competent authority "upon its request".

In Article 16(3), DORA told the ESAs to "develop common draft regulatory technical standards" for the simplified ICT risk management framework. These regulatory technical standards are Title III of Delegated Regulation (EU) 2024/1774.

Rules that continue to apply to Article 16(1) entities

In DORA Article 16(1), Articles 5 to 15 do not apply to the entities that the first subparagraph gives. Chapters III to VI of DORA apply to the entities in Article 16(1). But some provisions of these chapters do not apply to them:

• Chapter III (ICT-related incidents) — these entities classify and report major ICT-related incidents. The rule on recurring incidents in Article 8(2) of Delegated Regulation (EU) 2024/1772 does not apply to them. For more information, see Article 16(1) entities and the incident rules.
• Chapter IV (digital operational resilience testing) — Article 26(1) excludes these entities from threat-led penetration testing. DORA does not make clear if the Article 24 testing program applies to these entities when they are not microenterprises (see Testing scope).
• Chapter V, Section I (ICT third-party risk) — Article 28(2) (strategy on ICT third-party risk) excludes these entities. The other paragraphs of Article 28, and Articles 29 and 30, do not exclude these entities by name. For more information, see Article 28.
• Chapter VI (information sharing) — Article 45 applies to them.

The microenterprise test (Article 3(60)) is a different test. An entity in Article 16(1) can also be a microenterprise.

Articles 1 to 6 and 16 in Modulos

Modulos gives DORA through OFF-16 at the Organization level and MFF-16 at the AI System level (see the Requirements). Modulos recommends records of the scope and Article 16(1) decisions although DORA does not tell financial entities to keep these records.

Where to go next

DORA overview

Dates, structure, penalties, and the Modulos Frameworks

ICT risk and resilience operations

Articles 7 to 23: the parts of the ICT risk management framework, incidents, and reports

Testing and third-party risk

Articles 24 to 44: digital operational resilience testing, ICT third-party risk, the register of information, and the Oversight Framework

Information sharing and Level 2 acts

Article 45 and the Commission Regulations that add to DORA

DORA in Modulos

The two Frameworks, the decisions before set-up, and the Requirements with their Articles

NIS2 vs DORA

How NIS2 Article 4 applies to financial entities in DORA

Sources

• Regulation (EU) 2022/2554 (DORA), OJ L 333, 27.12.2022, p. 1 (EUR-Lex): Articles 1 to 6 and 16. Article 3, points (9), (17), (19), (21) to (23), (30), (34), (53) and (60) to (62). Articles 8(3), 8(7), 11(1), 11(3), 11(7), 12(4), 13(6), 13(7), 15, 19(1), 24(1), 26(1), 28 to 31, 45 and 46. Recital 43.
• Commission Delegated Regulation (EU) 2024/1774 of 13 March 2024, OJ L, 25.6.2024 (EUR-Lex): Titles II and III, and Article 28.
• Commission Delegated Regulation (EU) 2024/1772 of 13 March 2024, OJ L, 25.6.2024 (EUR-Lex): Article 8(2).
• Directive (EU) 2022/2555 (NIS2), OJ L 333, 27.12.2022, p. 80 (EUR-Lex): Articles 2(1) to (4), 2(10), 3, 4(1) and (2), 21 and 23.

Disclaimer

This information is general. It is not legal advice. DORA applies directly in all Member States. The obligations come from DORA and from the Commission Regulations that add to DORA. The competent authorities in DORA Article 46 make sure of compliance.