Digital Operational Resilience Act (Regulation (EU) 2022/2554): ICT risk management, incident reporting and third-party oversight for financial entities
EU banks, payment institutions, insurers, investment firms and other financial entities must run an ICT risk management framework for which the management body bears ultimate responsibility, test their systems, keep business continuity and recovery plans, monitor ICT third-party risk and report major ICT-related incidents to their supervisors. Critical ICT third-party providers come under a direct EU oversight framework.
Scope. Reaches a US ICT provider (cloud, data or AI services) serving EU financial entities through their third-party risk duties (Articles 28-30); under Article 31(12) a financial entity may use a third-country provider designated as critical only if it has established an EU subsidiary within 12 months of designation.
Draft mapping. Drafted by the Register's agents from the rule's text and not yet confirmed by a person. It is the Register's reading, not legal advice: whether and how the rule applies to you is a question for counsel.
Controls this rule maps to
Required by the text The rule's text requires a measure that is this control, or plainly includes it. Implied A binding rule whose purpose needs this control, but whose text does not name it. The Register's reading. Recommended A voluntary standard or guidance recommends it; nothing binds you to it. Proposed Appears in a proposed rule or proposed provision that is not yet in force.
| Control | Strength | Where in the rule, and why | Confidence | Missing or failed in |
|---|---|---|---|---|
| Reporting integrity C-V2 | Required by the text | Article 19(1): 'Financial entities shall report major ICT-related incidents to the relevant competent authority'; Article 17(1): an incident management process 'to detect, manage and notify ICT-related incidents'. | high | 1 case |
| Recovery assets outside the failure domain C-R1 | Required by the text | Article 12(1)-(2): backup policies, restoration and recovery procedures and backup systems; Article 12(3): 'When restoring backup data using own systems, financial entities shall use ICT systems that are physically and logically segregated from the source ICT system'; Article 11 ICT business continuity policy. | high | not yet seen missing in a case |
| Provenance of the actor's software and hardware C-A3 | Implied | Article 28(1): manage ICT third-party risk as part of the ICT risk management framework; Article 28(3): 'maintain and update ... a register of information in relation to all contractual arrangements on the use of ICT services'; Article 31(12): use of a critical third-country provider only if it 'has established a subsidiary in the Union within the 12 months following the designation'. Records the provider, not the origin of the provider's code. | medium | 1 case |
| Least-privilege credential scoped to task C-E1 | Required by the text | Article 9(4)(c): 'implement policies that limit the physical or logical access to information assets and ICT assets to what is required for legitimate and approved functions and activities only'. | medium | 5 cases |
| Actor identity verification C-A1 | Required by the text | Article 9(4)(d): 'implement policies and protocols for strong authentication mechanisms, based on relevant standards and dedicated control systems'. | medium | 8 cases |
| Containment and isolation C-E5 | Implied | Article 9(4)(b): network management 'that may include implementing automated mechanisms to isolate affected information assets in the event of cyber-attacks', and the network connection infrastructure designed so 'that it can be instantaneously severed or segmented in order to minimise and prevent contagion'. | medium | 7 cases |