⁦DORA⁩

⁦European Union⁩ الأمن السيبراني

الحالة

⁦Applies since 17 January 2025.⁩✓المصادر: ⁦eiopa.europa.eu⁩, ⁦oeil.europarl.europa.eu⁩

على من ينطبق

⁦20 types of EU financial entities (banks, insurers, investment firms, payment/e-money institutions, crypto-asset service providers, etc.) and the ICT third-party service providers that serve them; critical ICT providers face direct EU oversight.⁩✓المصادر: ⁦eiopa.europa.eu⁩, ⁦eur-lex.europa.eu⁩, ⁦eiopa.europa.eu⁩

حدود الحجم

⁦None: applies to in-scope financial entities regardless of size, applied proportionately (Art 4). Small and non-interconnected investment firms, exempted payment and e-money institutions and small occupational pension funds use a simplified ICT risk framework (Art 16).⁩✓المصادر: ⁦eur-lex.europa.eu⁩, ⁦esma.europa.eu⁩, ⁦springlex.eu⁩

الجهة الرقابية

⁦National financial supervisors; European Supervisory Authorities (EBA, EIOPA, ESMA) oversee critical ICT third-party providers⁩✓المصادر: ⁦eiopa.europa.eu⁩, ⁦eiopa.europa.eu⁩

الإبلاغ عن الخروقات أو الحوادث

⁦Major ICT incidents: initial notice within 4h of classifying as major and no later than 24h after awareness; intermediate report within 72h of initial notice; final report within 1 month of the latest intermediate report.⁩✓المصادر: ⁦eur-lex.europa.eu⁩, ⁦advisera.com⁩

مسؤول حماية البيانات

⁦No named officer; the management body bears ultimate responsibility for ICT risk management.⁩✓المصادر: ⁦eur-lex.europa.eu⁩, ⁦oeil.europarl.europa.eu⁩

الممثل المحلي

⁦No EU representative duty, but EU financial entities may only use a non-EU critical ICT third-party provider if it sets up an EU subsidiary within 12 months of designation (Art 31(12)).⁩✓المصادر: ⁦eba.europa.eu⁩, ⁦springlex.eu⁩

أقصى عقوبة

⁦Set by Member States for financial entities. Critical ICT providers: periodic penalty payments up to 1% of average daily worldwide turnover.⁩

المعلومات الموسومة بعبارة «قيد التحقق» لا تزال قيد التأكيد ولا تُقدَّم كإجابات.

ما يجب عليك فعله✓

• ⁦Maintain a board-approved ICT risk management framework.⁩
• ⁦Classify ICT incidents and report major ones within 4h/24h, 72h and 1 month.⁩
• ⁦Keep a register of all ICT third-party contracts and include DORA-mandated contract terms.⁩
• ⁦Test digital resilience regularly; firms selected by supervisors (e.g. systemically important banks, large insurers and payment firms) run threat-led penetration tests.⁩
• ⁦Plan exit strategies for critical ICT providers.⁩

التغييرات الأخيرة

⁦Incident-reporting RTS (Delegated Regulation 2025/301) and register-of-information rules apply; ESAs began designating critical ICT third-party providers in 2025.⁩✓

المصادر

• المصدر الأساسي: ⁦https://www.eiopa.europa.eu/digital-operational-resilience-act-dora_en⁩
• المصدر الثاني: ⁦https://advisera.com/cdr-2025-301/time-limits-for-the-initial-notification-and-for-the-intermediate-and-final-reports/⁩
• الجهة الرقابية: ⁦National financial supervisors; European Supervisory Authorities (EBA, EIOPA, ESMA) oversee critical ICT third-party providers⁩

✓ = مؤكَّد من مصدرين مستقلين، أحدهما على الأقل رسمي. كيف نتحقق

معلومات فقط، وليست استشارة قانونية. القوانين تتغير؛ تحقّق مع الجهة الرقابية أو محامٍ مؤهل قبل الاعتماد على هذه الصفحة. هل لاحظت خطأ؟ راسلنا على ⁦contact@⁩⁦glancedeskjurisdiction.com⁩.