The Commission delegated and implementing regulations that supplement DORA, drafted by the ESAs through their Joint Committee: ICT risk management, incident classification and reporting, the register of information, ICT services policy and subcontracting, TLPT, and oversight of critical providers.
The RTS that details DORA's ICT risk management requirements: security policies, asset management, cryptography, operations, logging, network security, change management, access control, incident detection and continuity, plus a separate simplified framework.
The RTS that turns DORA's six classification criteria into measurable materiality thresholds, defines when an incident is major, aggregates recurring incidents, sets the test for significant cyber threats and governs sharing with other member states.
The RTS that sets what goes into the initial notification, intermediate report and final report on a major ICT-related incident, the deadlines for each, weekend rules, late reporting, and the content of voluntary cyber threat notifications.
The ITS that provides the standard template, data glossary and procedures for reporting major ICT-related incidents and notifying significant cyber threats: joint submissions, secure channels, reclassification, outsourced and aggregated reporting.
The ITS that sets the 15 standard templates for the register of information on ICT third-party arrangements, the supply chain ranking, LEI and EUID identifiers, data quality principles and group-level registers.
The RTS that specifies the content of the policy on ICT services supporting critical or important functions: governance and annual review, contract lifecycle phases, ex-ante risk assessment, due diligence and assurance, conflicts of interest, monitoring and exit.
The RTS on subcontracting of ICT services that support critical or important functions: the conditions to check before allowing it, the contract terms it requires, approval or objection to material changes, and termination rights.
The RTS on threat-led penetration testing: which entities are required to test, the control team and test managers, provider requirements, the preparation, threat intelligence, red team and closure phases with deadlines, remediation, attestation and cross-border cooperation.
The delegated regulation that specifies how the ESAs apply DORA's four designation criteria to ICT third-party providers: a two-step assessment with a 10 % share test in step 1 and qualitative sub-criteria in step 2.
The delegated regulation that sets how much critical ICT third-party providers pay for ESA oversight: the turnover-based fee formula, the EUR 50 000 minimum, first-year and opt-in fees, and payment deadlines.
The RTS on the information ICT providers give when applying for designation and when overseen as critical providers, the subcontracting template, and how competent authorities assess responses to Lead Overseer recommendations.
Tell us what you're working on, whether it's a deployment, an audit, a security test or a cyber range. You'll speak with an engineer who can help you scope it.