Article 11Response and recovery
1. As part of the ICT risk management framework referred to in Article 6(1) and based on the identification requirements set out in Article 8, financial entities shall put in place a comprehensive ICT business continuity policy, which may be adopted as a dedicated specific policy, forming an integral part of the overall business continuity policy of the financial entity.
2. Financial entities shall implement the ICT business continuity policy through dedicated, appropriate and documented arrangements, plans, procedures and mechanisms aiming to:
(a) ensure the continuity of the financial entity’s critical or important functions;
(b) quickly, appropriately and effectively respond to, and resolve, all ICT-related incidents in a way that limits damage and prioritises the resumption of activities and recovery actions;
(c) activate, without delay, dedicated plans that enable containment measures, processes and technologies suited to each type of ICT-related incident and prevent further damage, as well as tailored response and recovery procedures established in accordance with Article 12;
(d) estimate preliminary impacts, damages and losses;
(e) set out communication and crisis management actions that ensure that updated information is transmitted to all relevant internal staff and external stakeholders in accordance with Article 14, and report to the competent authorities in accordance with Article 19.
3. As part of the ICT risk management framework referred to in Article 6(1), financial entities shall implement associated ICT response and recovery plans which, in the case of financial entities other than microenterprises, shall be subject to independent internal audit reviews.
4. Financial entities shall put in place, maintain and periodically test appropriate ICT business continuity plans, notably with regard to critical or important functions outsourced or contracted through arrangements with ICT third-party service providers.
5. As part of the overall business continuity policy, financial entities shall conduct a business impact analysis (BIA) of their exposures to severe business disruptions. Under the BIA, financial entities shall assess the potential impact of severe business disruptions by means of quantitative and qualitative criteria, using internal and external data and scenario analysis, as appropriate. The BIA shall consider the criticality of identified and mapped business functions, support processes, third-party dependencies and information assets, and their interdependencies. Financial entities shall ensure that ICT assets and ICT services are designed and used in full alignment with the BIA, in particular with regard to adequately ensuring the redundancy of all critical components.
6. As part of their comprehensive ICT risk management, financial entities shall:
(a) test the ICT business continuity plans and the ICT response and recovery plans in relation to ICT systems supporting all functions at least yearly, as well as in the event of any substantive changes to ICT systems supporting critical or important functions;
(b) test the crisis communication plans established in accordance with Article 14.
For the purposes of the first subparagraph, point (a), financial entities, other than microenterprises, shall include in the testing plans scenarios of cyber-attacks and switchovers between the primary ICT infrastructure and the redundant capacity, backups and redundant facilities necessary to meet the obligations set out in Article 12.
Financial entities shall regularly review their ICT business continuity policy and ICT response and recovery plans, taking into account the results of tests carried out in accordance with the first subparagraph and recommendations stemming from audit checks or supervisory reviews.
7. Financial entities, other than microenterprises, shall have a crisis management function, which, in the event of activation of their ICT business continuity plans or ICT response and recovery plans, shall, inter alia, set out clear procedures to manage internal and external crisis communications in accordance with Article 14.
8. Financial entities shall keep readily accessible records of activities before and during disruption events when their ICT business continuity plans and ICT response and recovery plans are activated.
9. Central securities depositories shall provide the competent authorities with copies of the results of the ICT business continuity tests, or of similar exercises.
10. Financial entities, other than microenterprises, shall report to the competent authorities, upon their request, an estimation of aggregated annual costs and losses caused by major ICT-related incidents.
11. In accordance with Article 16 of Regulations (EU) No 1093/2010, (EU) No 1094/2010 and (EU) No 1095/2010, the ESAs, through the Joint Committee, shall by 17 July 2024 develop common guidelines on the estimation of aggregated annual costs and losses referred to in paragraph 10.
DORA, the European Union regulation on digital operational resilience, Article 11
Response and recovery, built on the asset identification in Article 8. Entities need an ICT business continuity policy, which may sit within the overall continuity policy. They implement it through documented arrangements to keep critical or important functions running; to respond to and resolve incidents while limiting damage; to activate containment without delay; to estimate preliminary impacts and losses; and to set out communication, crisis management and reporting to authorities under Article 19.
Response and recovery plans must be in place; for entities other than microenterprises they are subject to independent internal audit review. A business impact analysis is required, and ICT assets and services must align with it, including redundancy of critical components.
Continuity and response and recovery plans must be tested at least yearly, and after substantive changes to systems supporting critical or important functions; crisis communication plans must be tested too. Entities other than microenterprises must include cyber-attack scenarios and switchovers to redundant capacity, backups and facilities. Policies and plans are reviewed in light of test results and audit or supervisory recommendations.
All entities must keep readily accessible records of activity before and during disruption. Entities other than microenterprises must also have a crisis management function and, on request, report estimated aggregated annual costs and losses from major incidents; Article 11(11) required the ESAs to develop common guidelines on estimating them by 17 July 2024. Central securities depositories give authorities copies of the results of their continuity tests or similar exercises.
What is in the packs for this
Each one helps with this requirement.
DORA Article-to-Control Mapping LibraryExcel
in DORA ICT Risk & Resilience Readiness
Requirement Library rows RQ-16, RQ-17, RQ-18: each gives the provision in plain words, what an entity must be able to show and the documents that help.
DORA Readiness Self-AssessmentExcel
in DORA ICT Risk & Resilience Readiness
Readiness items RM-06 rate how ready the entity is for the provision, with the evidence behind each rating and the gap.
ICT Risk Management Framework Document TemplateWord
in DORA ICT Risk & Resilience Readiness
Statement FW-29 on the ICT business continuity policy.
Digital Operational Resilience Testing ProgrammeExcel
in DORA ICT Risk & Resilience Readiness
Programme rows DT-14 and DT-15 schedule the yearly test of the continuity, response and recovery plans and of the crisis communication plans.
Exercise Planning & Facilitation ProcedureWord
in Cyber Incident Exercises & Tabletop Scenario Library
The note under Adapting this template sets yearly tests, cyber-attack scenarios and reviewing plans on the results.
Business Continuity & ICT Resilience PolicyWord
in Cyber Resilience & Recovery
Covers the continuity policy, plans and recovery order, crisis roles, the business impact analysis and dependencies, and recovery tests at least yearly including cyber-attack scenarios.
Cyber Recovery Operating ProcedureWord
in Cyber Resilience & Recovery
R1 activates the plans, limits damage and orders recovery actions; R7 keeps the crisis log readily accessible.
Critical Service Recovery Objectives Matrix (RTO, RPO, MTD)Excel
in Cyber Resilience & Recovery
The Impact Analysis sheet records the impact of a severe disruption over time; the Dependencies sheet records third-party dependencies.
Cyber Recovery Plan TemplateWord
in Cyber Resilience & Recovery
PS-9 holds each supplier's contracted recovery time, PS-11 records the plan's tests and results, and the note under Adapting this template covers independent review of response and recovery plans.
Crisis & Recovery Responsibility MatrixExcel
in Cyber Resilience & Recovery
The Crisis Team sheet names who forms the crisis management function.
Text: Regulation (EU) 2022/2554, as published in the Official Journal of the European Union, from EUR-Lex. Only the Official Journal text is authentic.