{"licence":{"name":"CC BY-SA 4.0","spdx":"CC-BY-SA-4.0","url":"https://creativecommons.org/licenses/by-sa/4.0/","attribution":"Atlas, a bilingual technical dictionary (https://cmaintz.github.io/tech-atlas/)"},"id":"security/dora","url":{"en":"https://cmaintz.github.io/tech-atlas/en/terms/security/dora/","da":"https://cmaintz.github.io/tech-atlas/da/terms/security/dora/"},"term":{"en":"DORA","da":"DORA-forordningen"},"aka":{"en":["Digital Operational Resilience Act","Regulation (EU) 2022/2554"],"da":["DORA","forordning (EU) 2022/2554","forordningen om digital operationel modstandsdygtighed"]},"domain":["security"],"cluster":"compliance","layer":"governance","status":"current","era":2022,"summary":{"en":"The EU law that makes banks, insurers and other financial firms able to keep running through IT failures and cyber attacks.","da":"EU-forordningen, der skal sikre, at banker, forsikringsselskaber og andre finansielle virksomheder kan klare IT-nedbrud og cyberangreb."},"body":{"formal":{"en":"An EU regulation of 14 December 2022, applying directly in every member state from 17 January 2025, that sets one set of rules for the financial sector on IT risk management, incident reporting, testing, and control of IT suppliers such as cloud providers.","da":"En EU-forordning af 14. december 2022, der gælder direkte i alle medlemslande fra 17. januar 2025, og som giver finanssektoren ét regelsæt for styring af IT-risici, indberetning af hændelser, test og kontrol med IT-leverandører som fx cloududbydere."},"plain":{"en":"Like fire rules that ask a bank not just to hang smoke alarms, but to prove in a drill that it can get everyone out, keep serving customers and tell the fire service what happened.","da":"Som brandregler, der ikke bare kræver røgalarmer i banken, men at den ved en øvelse beviser, at den kan få alle ud, blive ved med at betjene kunderne og fortælle brandvæsenet, hvad der skete."},"inPractice":{"en":"The IT risk manager at a Danish pension fund keeps a register of every IT supplier contract, tests switching over to the backup site each year and, after a major outage, sends the first report to the Danish financial supervisor within hours.","da":"Den IT-risikoansvarlige i en dansk pensionskasse fører et register over alle aftaler med IT-leverandører, tester hvert år skiftet til backup-sitet og sender efter et større nedbrud den første indberetning til Finanstilsynet inden for få timer."},"whyItMatters":{"en":"Payments, savings and trading now depend almost wholly on IT and a few shared cloud providers, so one failure can spread across the whole financial system; DORA makes firms plan for that and lets supervisors check.","da":"Betalinger, opsparing og handel afhænger nu næsten helt af IT og nogle få fælles cloududbydere, så ét nedbrud kan sprede sig i hele det finansielle system; DORA tvinger virksomhederne til at planlægge for det og giver tilsynet mulighed for at kontrollere."}},"deepDive":{"en":"Regulation (EU) 2022/2554 covers some twenty categories of financial entity listed in Art. 2, from credit institutions, investment firms and insurers to payment and e-money institutions, crypto-asset service providers, trading venues and central counterparties, and is accompanied by an amending directive (EU) 2022/2556 that aligns sectoral directives. Most of the operational detail sits in level-2 acts: Commission Delegated Regulation (EU) 2024/1774 on the ICT risk-management framework (including logging and log retention), 2024/1772 on incident classification criteria, 2025/301 on the content and timing of incident reports, and implementing standards for the register of information. Proportionality is built in via Art. 4, and Art. 16 gives small and non-interconnected entities a simplified risk-management framework; microenterprises are relieved of several requirements.\n\nThe regulation has five pillars. ICT risk management (Arts. 5-16) makes the management body ultimately responsible (Art. 5(2)) and requires an ICT risk-management framework covering identification of assets and dependencies, protection, detection, response and recovery, backup and restoration, and learning. Incident management (Arts. 17-23) requires classification of ICT-related incidents against quantitative and qualitative criteria (clients affected, duration, geographic spread, data losses, criticality of services, economic impact); for a major incident, the initial notification is due within four hours of classifying it as major and no later than 24 hours after becoming aware, the intermediate report within 72 hours of the initial notification, and the final report within one month of the latest intermediate report. Digital operational resilience testing (Arts. 24-27) requires a risk-based testing programme with at least yearly testing of critical systems, and threat-led penetration testing (TLPT) on live production systems at least every three years for entities selected by the competent authority, modelled on the TIBER-EU framework.\n\nICT third-party risk (Arts. 28-30) requires a register of information on all contractual arrangements with ICT providers, pre-contract due diligence, exit strategies, and the mandatory contract clauses in Art. 30, which are stricter for services supporting critical or important functions. The oversight framework (Arts. 31-44) lets the European Supervisory Authorities designate critical ICT third-party providers and oversee them through a Lead Overseer; the first list of 19 providers, including major hyperscalers, was published on 18 November 2025 and is to be updated yearly. The fifth pillar, Art. 45, allows voluntary cyber threat information sharing.\n\nDORA is lex specialis to NIS2 for financial entities, and NIS2 Art. 4 defers to it, so a Danish bank reports major ICT incidents to Finanstilsynet under DORA rather than following NIS2 Art. 23 timelines. A common misreading is that DORA applies to cloud providers directly: it binds the financial entity, and only designated CTPPs are reached through ESA oversight; other suppliers are affected indirectly through the contract terms their customers must impose.","da":"Forordning (EU) 2022/2554 omfatter omkring tyve kategorier af finansielle enheder opregnet i art. 2, fra kreditinstitutter, investeringsselskaber og forsikringsselskaber til betalings- og e-pengeinstitutter, udbydere af kryptoaktivtjenester, markedspladser og centrale modparter, og den ledsages af et ændringsdirektiv (EU) 2022/2556, der tilpasser sektordirektiverne. Det meste af den operationelle detalje ligger i niveau 2-retsakter: Kommissionens delegerede forordning (EU) 2024/1774 om rammen for IKT-risikostyring (herunder logning og opbevaring af logs), 2024/1772 om kriterier for klassificering af hændelser, 2025/301 om indhold og frister for hændelsesrapporter samt gennemførelsesstandarder for informationsregistret. Proportionalitet er indbygget via art. 4, og art. 16 giver små og ikke-forbundne enheder en forenklet risikostyringsramme; mikrovirksomheder er fritaget for flere krav.\n\nForordningen har fem søjler. IKT-risikostyring (art. 5-16) gør ledelsesorganet endeligt ansvarligt (art. 5, stk. 2) og kræver en ramme, der dækker identifikation af aktiver og afhængigheder, beskyttelse, detektion, reaktion og genopretning, backup og gendannelse samt læring. Hændelseshåndtering (art. 17-23) kræver, at IKT-relaterede hændelser klassificeres efter kvantitative og kvalitative kriterier (berørte kunder, varighed, geografisk udbredelse, datatab, tjenesternes kritikalitet og økonomisk påvirkning); ved en større hændelse skal den første underretning sendes inden for fire timer efter klassificeringen som større og senest 24 timer efter kendskab, mellemrapporten inden for 72 timer efter den første underretning og den endelige rapport senest en måned efter den seneste mellemrapport. Test af digital operationel modstandsdygtighed (art. 24-27) kræver et risikobaseret testprogram med mindst årlig test af kritiske systemer og trusselsbaseret penetrationstest (TLPT) af produktionssystemer mindst hvert tredje år for enheder, som tilsynet udvælger, efter model af TIBER-EU.\n\nTredjepartsrisiko på IKT-området (art. 28-30) kræver et informationsregister over alle aftaler med IKT-leverandører, due diligence før aftaleindgåelse, exitstrategier og de obligatoriske kontraktvilkår i art. 30, som er skrappere for tjenester, der understøtter kritiske eller vigtige funktioner. Tilsynsrammen (art. 31-44) lader de europæiske tilsynsmyndigheder (ESA'erne) udpege kritiske tredjepartsudbydere af IKT-tjenester og føre tilsyn med dem via en ledende tilsynsførende; den første liste med 19 udbydere, herunder de store hyperscalere, blev offentliggjort 18. november 2025 og opdateres årligt. Den femte søjle, art. 45, giver mulighed for frivillig deling af trusselsoplysninger.\n\nDORA er lex specialis i forhold til NIS2 for finansielle enheder, og NIS2 art. 4 viger for den, så en dansk bank indberetter større IKT-hændelser til Finanstilsynet efter DORA frem for NIS2's frister i art. 23. En udbredt misforståelse er, at DORA gælder direkte for cloududbydere: den binder den finansielle enhed, og kun udpegede kritiske udbydere nås via ESA'ernes tilsyn; andre leverandører påvirkes indirekte gennem de kontraktvilkår, kunderne skal stille."},"edges":[{"type":"kind-of","to":"security/eu-regulation","confidence":"high","strength":"normal"},{"type":"contrasts-with","to":"security/nis2","why":{"en":"NIS2 covers many sectors; DORA is the stricter, more detailed rulebook for finance, and where both apply to a financial firm, DORA's rules take the lead.","da":"NIS2 dækker mange sektorer; DORA er det skrappere og mere detaljerede regelsæt for finanssektoren, og hvor begge gælder for en finansiel virksomhed, går DORA forud."},"confidence":"high","strength":"primary"},{"type":"mandates","to":"security/incident-reporting","why":{"en":"Article 19 requires major IT incidents to be reported to the financial supervisor in stages - first notice, update and final report.","da":"Artikel 19 kræver, at større IT-hændelser indberettes til finanstilsynet i trin - første underretning, opdatering og endelig rapport."},"confidence":"high","strength":"primary"},{"type":"mandates","to":"security/supplier-management","why":{"en":"Articles 28-30 require firms to manage the risk from IT suppliers, keep a register of contracts and put set terms into them.","da":"Artikel 28-30 kræver, at virksomhederne styrer risikoen fra IT-leverandører, fører et register over aftaler og indsætter faste vilkår i dem."},"confidence":"high","strength":"primary"},{"type":"mandates","to":"security/penetration-test","why":{"en":"Article 26 requires selected large firms to run threat-led penetration tests on live systems at least every three years.","da":"Artikel 26 kræver, at udvalgte store virksomheder får lavet trusselsbaserede penetrationstest af produktionssystemer mindst hvert tredje år."},"confidence":"high","strength":"normal"},{"type":"mandates","to":"security/business-continuity-plan","why":{"en":"Article 11 requires an IT business continuity policy with plans that are tested regularly.","da":"Artikel 11 kræver en politik for IT-forretningskontinuitet med planer, der testes regelmæssigt."},"confidence":"high","strength":"normal"},{"type":"mandates","to":"security/log-retention","why":{"en":"Under the RTS on ICT risk management (Delegated Regulation (EU) 2024/1774, Art. 12), financial entities must set and document how long logs are kept, based on their risk assessment.","da":"Efter RTS'en om IKT-risikostyring (delegeret forordning (EU) 2024/1774, art. 12) skal finansielle enheder fastsætte og dokumentere, hvor længe logs gemmes, ud fra deres risikovurdering."},"confidence":"high","strength":"normal"}],"depth":0,"sources":[{"title":"Regulation (EU) 2022/2554 (Digital Operational Resilience Act)","url":"https://eur-lex.europa.eu/eli/reg/2022/2554/oj","tier":"standard","publisher":"European Union"}],"draft":true}