EU Digital Operational Resilience Act (2022/2554)
EU regulation establishing uniform requirements for ICT risk management, incident reporting, digital operational resilience testing, and ICT third-party risk management across financial entities. Covers banks, insurers, investment firms, crypto-asset service providers, and critical ICT third-party providers. Requires threat-led penetration testing (TLPT) and comprehensive ICT third-party oversight.
| Clause | Title | SP 800-53 Controls |
|---|---|---|
| Art.5(1) | Governance and organisation — management body responsibility | |
| Art.5(2) | Governance and organisation — management body approval of digital operational resilience strategy | |
| Art.5(4) | Governance and organisation — ICT risk management training for management body | |
| Art.6(1) | ICT risk management framework — establishment and maintenance | |
| Art.6(2) | ICT risk management framework — risk assessment and documentation | |
| Art.6(4) | ICT risk management framework — review and audit | |
| Art.6(5) | ICT risk management framework — formal reporting to management body | |
| Art.6(8) | ICT risk management framework — documentation and review availability | |
| Art.7(1) | ICT systems, protocols and tools — reliability and capacity | |
| Art.7(2) | ICT systems, protocols and tools — keep systems up to date | |
| Art.8(1) | Identification — ICT asset identification and classification | |
| Art.8(4) | Identification — ICT asset register and classification | |
| Art.8(5) | Identification — ICT risk assessment on legacy systems | |
| Art.9(1) | Protection and prevention — ICT security policies | |
| Art.9(2) | Protection and prevention — ICT system resilience and availability | |
| Art.9(3) | Protection and prevention — data integrity, confidentiality, and availability safeguards | |
| Art.9(4)(a) | Protection and prevention — network security management | |
| Art.9(4)(b) | Protection and prevention — data leakage, malware, and media protection | |
| Art.9(4)(c) | Protection and prevention — access control and authentication | |
| Art.9(4)(d) | Protection and prevention — strong authentication and identity management | |
| Art.9(4)(e) | Protection and prevention — change management and software security | |
| Art.10(1) | Detection — anomalous activities and ICT-related incidents | |
| Art.10(2) | Detection — multiple layers of control and alert thresholds | |
| Art.11(1) | Response and recovery — ICT business continuity policy | |
| Art.11(2) | Response and recovery — recovery time and point objectives | |
| Art.11(3) | Response and recovery — impact analysis of ICT disruption scenarios | |
| Art.11(4) | Response and recovery — ICT response and recovery plans | |
| Art.11(6) | Response and recovery — testing of ICT business continuity plans | |
| Art.11(7) | Response and recovery — crisis communication plans | |
| Art.12(1) | Backup policies and recovery — backup policy development | |
| Art.12(2) | Backup policies and recovery — restoration and recovery from backups | |
| Art.12(3) | Backup policies and recovery — backup data integrity and confidentiality | |
| Art.12(5) | Backup policies and recovery — geographically separated backup site | |
| Art.13(1) | Learning and evolving — gathering information on vulnerabilities and cyber threats | |
| Art.13(6) | Learning and evolving — ICT security awareness and training programmes | |
| Art.14 | Communication — policies for internal and external communication on ICT-related incidents | |
| Art.15 | Simplified ICT risk management framework — proportionality for smaller entities | |
| Art.16 | Further harmonisation of ICT risk management tools, methods, processes, and policies | |
| Art.17(1) | ICT-related incident management process — establishment | |
| Art.17(2) | ICT-related incident management process — indicators and procedures | |
| Art.17(3) | ICT-related incident management process — response procedures | |
| Art.17(3)(c) | ICT-related incident management process — incident monitoring | |
| Art.17(3)(d) | ICT-related incident management process — training and communication | |
| Art.18(1) | Classification of ICT-related incidents — classification criteria | |
| Art.18(2) | Classification of ICT-related incidents — major incident determination | |
| Art.19(1) | Reporting of major ICT-related incidents — notification to competent authority | |
| Art.19(4) | Reporting of major ICT-related incidents — incident report content and timelines | |
| Art.20(1) | Harmonisation of reporting content and templates | |
| Art.22(1) | Supervisory feedback on incident reports | |
| Art.24(1) | Digital operational resilience testing — programme establishment | |
| Art.24(2) | Digital operational resilience testing — proportionality and risk-based approach | |
| Art.25(1) | Testing of ICT tools and systems — scope and methods | |
| Art.25(2) | Testing of ICT tools and systems — developer testing | |
| Art.26 | Advanced testing — threat-led penetration testing (TLPT) | |
| Art.27 | Requirements for TLPT testers — qualifications and independence | |
| Art.28(1)(a) | ICT third-party risk management — general principles and responsibility | |
| Art.28(2) | ICT third-party risk management — proportionate risk management strategy | |
| Art.28(4) | ICT third-party risk management — register of ICT third-party arrangements | |
| Art.28(5) | ICT third-party risk management — due diligence and risk assessment before contracting | |
| Art.28(6) | ICT third-party risk management — monitoring and audit rights | |
| Art.28(7) | ICT third-party risk management — incident notification by providers | |
| Art.28(8) | ICT third-party risk management — exit strategies | |
| Art.29(1) | ICT concentration risk — preliminary assessment | |
| Art.30(2) | Key contractual provisions — minimum requirements for ICT service contracts | |
| Art.30(2)(a) | Key contractual provisions — service descriptions and SLAs | |
| Art.30(2)(g) | Key contractual provisions — termination and data return | |
| Art.30(3) | Key contractual provisions — critical or important functions | |
| Art.45(1) | Information-sharing arrangements — voluntary sharing of cyber threat intelligence |