DORA Definitions

Regulation (EU) 2022/2554

DORA Article 3 defines the vocabulary used for digital operational resilience in the EU financial sector. See the DORA space.

• digital operational resilience
• network and information system
• legacy ICT system
• security of network and information systems
• ICT risk
• information asset
• ICT asset
• ICT-related incident
• operational or security payment-related incident
• major ICT-related incident
• major operational or security payment-related incident
• cyber threat
• significant cyber threat
• cyber-attack
• threat intelligence
• vulnerability
• threat-led penetration testing (TLPT)
• ICT third-party risk
• ICT third-party service provider
• ICT intra-group service provider
• ICT services
• critical or important function
• critical ICT third-party service provider
• ICT third-party service provider established in a third country
• subsidiary
• group
• parent undertaking
• ICT subcontractor established in a third country
• ICT concentration risk
• management body
• credit institution
• institution exempted pursuant to Directive 2013/36/EU
• investment firm
• small and non-interconnected investment firm
• payment institution
• payment institution exempted pursuant to Directive (EU) 2015/2366
• account information service provider
• electronic money institution
• electronic money institution exempted pursuant to Directive 2009/110/EC
• central counterparty
• trade repository
• central securities depository
• trading venue
• manager of alternative investment funds
• management company
• data reporting service provider
• insurance undertaking
• reinsurance undertaking
• insurance intermediary
• ancillary insurance intermediary
• reinsurance intermediary
• institution for occupational retirement provision
• small institution for occupational retirement provision
• credit rating agency
• crypto-asset service provider
• issuer of asset-referenced tokens
• administrator of critical benchmarks
• crowdfunding service provider
• securitisation repository
• microenterprise
• Lead Overseer
• Joint Committee
• small enterprise
• medium-sized enterprise
• public authority