EveryAILaw.comDoes Digital Operational Resilience Act (DORA) require Risk Assessment?
European Union • enforcing
Yes — 2 provisions
Requirements at a glance
This regulation imposes 9 specific requirements for Risk Assessment across 2 provisions:
- ICT risk management framework — Comprehensive framework for identifying, assessing, and mitigating ICT risks
- Governance — Management body must approve and oversee the ICT risk management framework
- Business continuity — Establish ICT business continuity and disaster recovery plans
- Cyber risk management — Address cybersecurity risks as part of the ICT risk framework
- Contractual requirements — Key contractual provisions for ICT third-party service agreements
- Concentration risk — Assess and manage concentration risk from third-party ICT dependencies
- Critical provider oversight — Designated critical third-party providers (CTPPs) subject to ESA oversight
- Exit strategies — Maintain exit strategies for critical ICT third-party services
- Register of Information — Maintain and keep up-to-date a register of information on all ICT third-party contractual arrangements, and submit it to competent authorities upon request or as required (DORA Article 28)
ICT Risk Management #
Requirements
| Requirement | Details |
|---|---|
| ICT risk management framework | Comprehensive framework for identifying, assessing, and mitigating ICT risks |
| Governance | Management body must approve and oversee the ICT risk management framework |
| Business continuity | Establish ICT business continuity and disaster recovery plans |
| Cyber risk management | Address cybersecurity risks as part of the ICT risk framework |
Penalties
| Violation | Fine |
|---|---|
| Non-compliance | Determined by national competent authorities per member state law |
Sources: DORA Full Text
Third-Party ICT Risk Management #
Requirements
| Requirement | Details |
|---|---|
| Contractual requirements | Key contractual provisions for ICT third-party service agreements |
| Concentration risk | Assess and manage concentration risk from third-party ICT dependencies |
| Critical provider oversight | Designated critical third-party providers (CTPPs) subject to ESA oversight |
| Exit strategies | Maintain exit strategies for critical ICT third-party services |
| Register of Information | Maintain and keep up-to-date a register of information on all ICT third-party contractual arrangements, and submit it to competent authorities upon request or as required (DORA Article 28) |
Penalties
| Violation | Fine |
|---|---|
| CTPP non-compliance | ESAs may impose periodic penalty payments on critical third-party providers |
Sources: DORA Full Text