Glossary term
DORA ICT risk management
Also: Digital Operational Resilience Act, DORA Art. 28, ICT third-party risk
The EU Digital Operational Resilience Act regulates the operational resilience of financial entities against ICT risks, with particularly prescriptive expectations around ICT third-party risk management (Art. 28) and contractual arrangements (Art. 30).
DORA applies to a wide range of financial entities in the EU and imposes a structured framework covering governance, risk management, incident reporting, operational resilience testing, third-party risk and information sharing. Unlike NIS2, DORA is highly prescriptive on the mechanics.
Art. 28 requires a structured ICT third-party register, classification of criticality, explicit risk assessments and exit strategies. Art. 29 covers concentration risk. Art. 30 defines the minimum contractual provisions that every ICT contract of record must include.
In practice
For the selection of ICT providers, DORA effectively requires an auditable decision memo per critical vendor. The memo must be producible on demand during supervisory review. Decision Readiness Score and structured vendor comparison were designed with exactly this evidence expectation in mind.
Related terms
NIS2 Art. 20
The NIS2 article that makes the management body of an essential or important entity directly accountable for approving and overseeing cybersecurity risk-management measures. Management bodies that fail this duty can be held personally liable.
Decision memo
A short structured document that captures why a decision was made, the options considered, the criteria and trade-offs, the stakeholders involved and the accepted risks. A good decision memo is auditable months later.
Audit-ready decision
A decision whose record is structured, evidence-backed and stakeholder-signed to a level that a third-party auditor, a supervisor or a board reviewer can reconstruct the reasoning without interviewing the original team.
Dealbreaker
A hard requirement that immediately disqualifies an option if not met, independent of weighted scoring. Dealbreakers enforce non-negotiable constraints (EU hosting, specific certifications, data residency) and prevent weak options from winning on aggregate scores.
Defensible record
A single versioned artefact that captures a decision in enough structure, with enough evidence and stakeholder context, that it can be defended under audit, in a board review, or 12 months later when the original team is no longer in place.
DLP
Software category for detecting and preventing unauthorised data outflow. Operates on endpoints, network and cloud. Classifies content (regex, fingerprinting, ML) and enforces policies.
DMARC / DKIM / SPF
Three standards that together authenticate email senders and impede spoofing. SPF authenticates the sending IP, DKIM signs the content, DMARC links both via the From header and defines the policy.
DORA
EU regulation on digital operational resilience in the financial sector. Directly applicable since 17 January 2025. Five pillars: ICT risk management, incident management, resilience testing including TLPT, third-party governance, information sharing.