Products Coverage Library Evals FAQ About Contact us Log In Get access

Digital operational Resilience Act (DORA)

Preamble
Recitals 106
Chapter I - General provisions (Article 1-4) 4
Chapter II - ICT risk management (Article 5-16) 12
Chapter III - ICT-related incident management, classification and reporting (Article 17-23) 7
Chapter IV - Digital operational resilience testing (Article 24-27) 4
Chapter V - Managing of ICT third-party risk (Article 28-44) 17
Chapter VI - Information-sharing arrangements (Article 45) 1
Chapter VII - Competent authorities (Article 46-56) 11
Chapter VIII - Delegated acts (Article 57) 1
Chapter IX - Transitional and final provisions (Article 58-64) 7

ICT third-party risk

Defined in Article 3, Digital operational Resilience Act (DORA)

Definitions over time (1)

16/01/2023 – today applies on 12/11/2026 Article 3, Digital operational Resilience Act (DORA) Scope: Whole act

For the purposes of this Regulation, the following definitions shall apply:

‘ICT third-party risk’ means an ICT risk that may arise for a financial entity in relation to its use of ICT services provided by ICT third-party service providers or by subcontractors of the latter, including through outsourcing arrangements;

Used in (31 places in 20 provisions on 12/11/2026)

Digital operational Resilience Act (DORA) (31 in 20)

Recital 9 · Recital 12 · Recital 21 · Recital 29 · Recital 30 · Recital 43 · Recital 62 · Recital 65² · Recital 76 · Recital 79 · Recital 80 · Recital 88² · Recital 99 · Article 1² · Article 3 · Article 28⁵ · Article 32² · Article 36² · Article 42² · Article 44²