Operational resilience
A firm’s ability to keep delivering its important services through disruption, within limits it has set and tested.
Resilience regimes ask firms to identify their important business services, set impact tolerances for disruption, map what the services depend on, and test that they can stay within tolerance under severe but plausible scenarios.
DORA brings detailed ICT risk, incident reporting and third-party rules to EU financial entities.
Where the rules use it.
- DORA — Digital Operational Resilience ActICT risk management, incident reporting, resilience testing and third-party risk for financial entities.European Union · 8 controls
- UK Operational Resilience (FCA SYSC 15A / PRA SS1/21)Important business services, impact tolerances, mapping and scenario testing.United Kingdom · 5 controls
- CSSF Circular 20/750 — ICT and security risk managementEBA ICT and security risk guidelines applied to Luxembourg entities outside DORA's scope.Luxembourg · 5 controls
- GFSC Cyber Security Rules and GuidanceBoard-owned cyber security based on the NIST functions, for all licensees.Guernsey · 5 controls