Translations:Digital Operational Resilienec Act (DORA)/26/en

To support financial entities in implementing these requirements, the European Supervisory Authorities have issued several technical regulatory standards. These include provisions on the tools, methods, processes, and policies for ICT risk management, as well as simplified risk management frameworks for microenterprises. Further RTS specify criteria for classifying ICT incidents and cyber threats, as well as materiality thresholds and reporting requirements for major incidents. Reporting and classification of ICT-related incidents must be carried out using harmonised standard templates. The authorities to which reports must be submitted differ from those under the NIS2 Directive. Clear determination and internal communication of reporting obligations and recipient authorities is essential.