DORA – Verordening (EU) 2022/2554 inzake digitale operationele weerbaarheid

Is het op mij van toepassing?

Rechtstreeks geldt DORA voor financiële ondernemingen volgens art. 2, zoals kredietinstellingen, betalings- en e-geldinstellingen, beleggingsondernemingen, beheerders van beleggingsinstellingen, verzekerings- en herverzekeringsondernemingen en aanbieders van cryptodiensten. In Duitsland verruimen § 1a lid 2 KWG, § 1a lid 2a KWG (meldplichten sinds 17 januari 2025, voor het overige vanaf 1 januari 2027) en § 293 lid 5 VAG de kring. Voor micro-ondernemingen en ondernemingen in het vereenvoudigde kader volgens art. 16 gelden versoepelingen. Voor financiële ondernemingen gaat DORA als specifiekere rechtshandeling voor op de NIS2-regelgeving, voor zover DORA gelijkwaardige eisen bevat (art. 4 NIS2-richtlijn).

IT-, cloud-, software- en managed-serviceaanbieders worden als ICT-derdedienstverleners indirect geraakt: hun financiële klanten blijven volledig verantwoordelijk en moeten van hen contractinhoud volgens art. 30, audit- en toegangsrechten, ondersteuning bij incidenten, medewerking aan tests en exitregelingen eisen. Een eigen fase in de module leidt dienstverleners door deze eisen.

Rechtsgrondslag

• Art. 2 DORAArticle 2 DORA Scope1. Without prejudice to paragraphs 3 and 4, this Regulation applies to the following entities: - (a) credit institutions; - (b) payment institutions, including payment institutions exempted pursuant to Directive (EU) 2015/2366; - (c) account information service providers; - (d) electronic money institutions, including electronic money institutions exempted pursuant to Directive 2009/110/EC; - (e) investment firms; - …Stand: 05.10.2026 · Bron: EUR-LexOrigineel openen (EUR-Lex) ↗Toepassingsgebied
• Art. 3 DORAArticle 3 DORA DefinitionsFor the purposes of this Regulation, the following definitions shall apply: (1) ‘digital operational resilience’ means the ability of a financial entity to build, assure and review its operational integrity and reliability by ensuring, either directly or indirectly through the use of services provided by ICT third-party service providers, the full range of ICT-related capabilities needed to address the security of …Stand: 05.10.2026 · Bron: EUR-LexOrigineel openen (EUR-Lex) ↗Definities, o.a. ICT-diensten en kritieke of belangrijke functie
• Art. 5 DORAArticle 5 DORA Governance and organisation1. Financial entities shall have in place an internal governance and control framework that ensures an effective and prudent management of ICT risk, in accordance with Article 6(4), in order to achieve a high level of digital operational resilience. 2. The management body of the financial entity shall define, approve, oversee and be responsible for the implementation of all arrangements related to the ICT risk …Stand: 05.10.2026 · Bron: EUR-LexOrigineel openen (EUR-Lex) ↗Governance en verantwoordelijkheid van het leidinggevende orgaan
• Art. 16 DORAArticle 16 DORA Simplified ICT risk management framework1. Articles 5 to 15 of this Regulation shall not apply to small and non-interconnected investment firms, payment institutions exempted pursuant to Directive (EU) 2015/2366; institutions exempted pursuant to Directive 2013/36/EU in respect of which Member States have decided not to apply the option referred to in Article 2(4) of this Regulation; electronic money institutions exempted pursuant to Directive …Stand: 05.10.2026 · Bron: EUR-LexOrigineel openen (EUR-Lex) ↗Vereenvoudigd ICT-risicobeheerkader
• Art. 19 DORAArticle 19 DORA Reporting of major ICT-related incidents and voluntary notification of significant cyber threats1. Financial entities shall report major ICT-related incidents to the relevant competent authority as referred to in Article 46 in accordance with paragraph 4 of this Article. Where a financial entity is subject to supervision by more than one national competent authority referred to in Article 46, Member States shall designate a single competent authority as the relevant competent authority responsible for carrying …Stand: 05.10.2026 · Bron: EUR-LexOrigineel openen (EUR-Lex) ↗Melding van ernstige ICT-gerelateerde incidenten
• Art. 28 DORAArticle 28 DORA General principles1. Financial entities shall manage ICT third-party risk as an integral component of ICT risk within their ICT risk management framework as referred to in Article 6(1), and in accordance with the following principles: - (a) financial entities that have in place contractual arrangements for the use of ICT services to run their business operations shall, at all times, remain fully responsible for compliance with, and …Stand: 05.10.2026 · Bron: EUR-LexOrigineel openen (EUR-Lex) ↗ICT-derdepartijrisico en informatieregister
• Art. 30 DORAArticle 30 DORA Key contractual provisions1. The rights and obligations of the financial entity and of the ICT third-party service provider shall be clearly allocated and set out in writing. The full contract shall include the service level agreements and be documented in one written document which shall be available to the parties on paper, or in a document with another downloadable, durable and accessible format. 2. The contractual arrangements on the use …Stand: 05.10.2026 · Bron: EUR-LexOrigineel openen (EUR-Lex) ↗Essentiële contractbepalingen
• Art. 5 DelVO (EU) 2025/301Article 5 Delegated Regulation (EU) 2025/301 Time limits for the initial notification, and for the intermediate and final reports1. Financial entities shall submit the initial notification and the intermediate and final reports as referred to in Article 19(4), points (a), (b) and (c), of Regulation (EU) 2022/2554 within the following time limits: - (a) for the initial report: as early as possible, but in any case, within four hours from the classification of the ICT-related incident as a major ICT-related incident and no later than 24 hours …Stand: 06.10.2026 · Bron: EUR-LexOrigineel openen (EUR-Lex) ↗Termijnen voor eerste melding, tussentijds en eindrapport