Regulatory Technical Standards (RTS) and Implementation Technical Standards (ITS)
Alongside the requirements set out in the Regulation, various topics are further elaborated in the delegated and implementing regulations. All DORA-related delegated and implementing regulations are listed below.
ICT risk management
- Delegated regulation 2024/1774 (ICT risk management framework and simplified ICT risk management framework)
ICT-related incidents
- Delegated regulation 2024/1772 (Criteria for the classification of major ICT-related incidents)
- Delegated regulation 2025/301 (Content and reporting timelines for major ICT-related incidents)
- Implementing regulation 2025/302 (forms, templates and procedures for major ICT-related incident reporting)
Digital operational resilience testing
- Delegated regulation 2025/1190 (Threat-led penetration testing (TLPT))
ICT third-party risk management
- Delegated regulation 2024/1773 (Policy on the use of ICT services supporting critical or impartant functions provided by ICT-third party service providers)
- Implementing regulation 2024/2956 (templates for the Register of information)
- Delegated regulation 2025/532 (Elements that a financial entity has to determine and assess when subcontracting ICT services supporting critical or important functions)