DORA Trifecta – Three Delegated Regulations Adopted By The Commission

Three delegated regulations under the Regulation on digital operational resilience for the financial sector (Regulation (EU) 2022/2554 or “DORA”) have been adopted by the European Commission. These newly adopted regulations set out regulatory technical standards (“RTS”) which mainly focus on the management of ICT-related incidents, contractual relationships with ICT service providers, and ICT risk management tools including the simplified ICT management framework.

• Classification of ICT-related Incidents and Cyber Threats:  The first regulation (C(2024) 1519 final) establishes RTS that define the criteria for categorizing ICT-related incidents and cyber threats. It outlines materiality thresholds and specifies the requirements for reporting significant incidents. These RTS emanate from Article 18(4) of DORA, aiming to ensure a robust framework for identifying and addressing digital threats in the financial sector.