Here you can find the official text of DORA (EU) Regulation 2022/2554 – you can easily browse through the text by clicking through chapters and articles, or by searching for keywords in the left-hand side menu.

Chapter 1  –  General provisions

Article 1– Subject matter

Article 2– Scope

Article 3– Definitions

Article 4– Proportionality principle

Chapter 2  –  ICT risk management

Section 1

Article 5– Governance and organisation

Section 2

Article 6– ICT risk management framework

Article 7– ICT systems, protocols and tools

Article 8– Identification

Article 9– Protection and prevention

Article 10– Detection

Article 11– Response and recovery

Article 12– Backup policies and procedures, restoration and recovery procedures and methods

Article 13– Learning and evolving

Article 14– Communication

Article 15– Further harmonisation of ICT risk management tools, methods, processes and policies

Article 16– Simplified ICT risk management framework

Chapter 3  –  ICT-related incident management, classification and reporting

Article 17– ICT-related incident management process

Article 18– Classification of ICT-related incidents and cyber threats

Article 19– Reporting of major ICT-related incidents and voluntary notification of significant cyber threats

Article 20– Harmonisation of reporting content and templates

Article 21– Centralisation of reporting of major ICT-related incidents

Article 22– Supervisory feedback

Article 23– Operational or security payment-related incidents concerning credit institutions, payment institutions, account information service providers, and electronic money institutions

Chapter 4  –  Digital operational resilience testing

Article 24– General requirements for the performance of digital operational resilience testing

Article 25– Testing of ICT tools and systems

Article 26– Advanced testing of ICT tools, systems and processes based on TLPT

Article 27– Requirements for testers for the carrying out of TLPT

Chapter 5  –  Managing of ICT third-party risk

Section 1  –  Key principles for a sound management of ICT third-party risk

Article 28– General principles

Article 29– Preliminary assessment of ICT concentration risk at entity level

Article 30– Key contractual provisions

Section 2  –  Oversight Framework of critical ICT third-party service providers

Article 31– Designation of critical ICT third-party service providers

Article 32– Structure of the Oversight Framework

Article 33– Tasks of the Lead Overseer

Article 34– Operational coordination between Lead Overseers

Article 35– Powers of the Lead Overseer

Article 36– Exercise of the powers of the Lead Overseer outside the Union

Article 37– Request for information

Article 38– General investigations

Article 39– Inspections

Article 40– Ongoing oversight

Article 41– Harmonisation of conditions enabling the conduct of the oversight activities

Article 42– Follow-up by competent authorities

Article 43– Oversight fees

Article 44– International cooperation

Chapter 6  –  Information-sharing arrangements

Article 45– Information-sharing arrangements on cyber threat information and intelligence

Chapter 7  –  Competent authorities

Article 46– Competent authorities

Article 47– Cooperation with structures and authorities established by Directive (EU) 2022/2555

Article 48– Cooperation between authorities

Article 49– Financial cross-sector exercises, communication and cooperation

Article 50– Administrative penalties and remedial measures

Article 51– Exercise of the power to impose administrative penalties and remedial measures

Article 52– Criminal penalties

Article 53– Notification duties

Article 54– Publication of administrative penalties

Article 55– Professional secrecy

Article 56– Data Protection

Chapter 8  –  Delegated acts

Article 57– Exercise of the delegation

Chapter 9  –  Transitional and final provisions

Section 1

Article 58– Review clause

Section 2  –  Amendments

Article 59– Amendments to Regulation (EC) No 1060/2009

Article 60– Amendments to Regulation (EU) No 648/2012

Article 61– Amendments to Regulation (EU) No 909/2014

Article 62– Amendments to Regulation (EU) No 600/2014

Article 63– Amendment to Regulation (EU) 2016/1011

Article 64– Entry into force and application