Digital Operational Resilience Act (DORA) — Record-Keeping & Documentation

Q: Does Digital Operational Resilience Act (DORA) require Record-Keeping & Documentation?

Yes. Digital Operational Resilience Act (DORA) addresses Record-Keeping & Documentation through 1 provision.

Does Digital Operational Resilience Act (DORA) require Record-Keeping & Documentation?

European Union • enforcing

Yes — 1 provision

Requirements at a glance

This regulation imposes 3 specific requirements for Record-Keeping & Documentation across 1 provision:

Resilience testing program — Conduct regular testing of ICT systems and tools
Threat-led penetration testing — Significant entities must perform TLPT aligned with TIBER-EU
Documentation and remediation — Document test results and remediate identified vulnerabilities

Digital Operational Resilience Testing #

Obligation:

Record Keeping

enforcing

Effective:

Jan 17, 2025

Risk tier:

all

Scope:

financial entities listed in Article 2(1)(a)-(t) — credit institutions, payment and e-money institutions, investment firms, crypto-asset service providers, CSDs, CCPs, trading venues, trade repositories, AIFMs, management companies, insurance and reinsurance undertakings, IORPs, credit rating agencies and others

Requirements

Requirement	Details
Resilience testing program	Conduct regular testing of ICT systems and tools
Threat-led penetration testing	Significant entities must perform TLPT aligned with TIBER-EU
Documentation and remediation	Document test results and remediate identified vulnerabilities

Penalties

Violation	Fine
Non-compliance	Determined by national competent authorities per member state law

Sources: DORA Full Text

View full regulation View obligation Obligation matrix