Position paper - Implementation of the Digital Operational Resilience Act

The three European Supervisory Authorities (ESAs) are currently tackling the operational aspects of the Digital Operational Resilience Act (DORA). In this context, businesses from both the financial services and digital sector have identified areas of the legislation on which clarity is particularly needed. In order to ensure legal certainty and allow industry to properly prepare for the new rules, the ESAs should aim to further clarify the following:

• Level of aggregation within a Group to which DORA would apply.
• Criteria and process around designating critical information and communications technology (ICT) third-party providers.
• Procedures that apply to incident reporting.
• Consistency with other EU legislation.