{"license":"CC-BY-4.0","document":{"id":"76e1341d-193d-5e8b-a22b-3ecffa9c57db","slug":"eu-dora-2022-2554","title_original":"Regulation (EU) 2022/2554 on digital operational resilience for the financial sector (DORA)","title_it":"Regolamento (UE) 2022/2554 relativo alla resilienza operativa digitale per il settore finanziario (DORA)","title_fr":"Règlement (UE) 2022/2554 sur la résilience opérationnelle numérique du secteur financier (DORA)","title_es":"Reglamento (UE) 2022/2554 sobre la resiliencia operativa digital del sector financiero (DORA)","document_type":"regulation","jurisdiction":"EU","issuing_body":"European Parliament and Council of the European Union","official_number":"Regulation (EU) 2022/2554","date_adopted":"2022-12-14","date_in_force":"2023-01-16","status":"in_vigore","languages":["en","it","fr","es","de"],"official_translations":["it","fr","es","de"],"summary":{"it":"DORA armonizza le regole sulla gestione dei rischi ICT per banche, assicurazioni, imprese di investimento e altri soggetti finanziari. Prevede un quadro di gestione del rischio ICT, la segnalazione degli incidenti gravi, test di resilienza inclusi i test di penetrazione guidati dalla minaccia e la gestione del rischio da terze parti. Introduce inoltre la sorveglianza europea sui fornitori ICT critici, come i servizi cloud.","en":"DORA harmonises ICT risk-management rules for banks, insurers, investment firms and other financial entities. It requires an ICT risk-management framework, reporting of major incidents, resilience testing including threat-led penetration testing, and management of third-party risk. It also introduces EU-level oversight of critical ICT third-party providers such as cloud services.","fr":"DORA harmonise les règles de gestion des risques liés aux TIC pour les banques, assureurs, entreprises d'investissement et autres entités financières. Il impose un cadre de gestion des risques TIC, la notification des incidents majeurs, des tests de résilience dont des tests de pénétration fondés sur la menace, et la gestion du risque lié aux tiers. Il instaure aussi une surveillance européenne des prestataires tiers critiques de services TIC, comme le cloud.","es":"DORA armoniza las normas de gestión de riesgos TIC para bancos, aseguradoras, empresas de servicios de inversión y otras entidades financieras. Exige un marco de gestión del riesgo TIC, la notificación de incidentes graves, pruebas de resiliencia incluidas pruebas de penetración basadas en amenazas y la gestión del riesgo de terceros. Introduce además la supervisión europea de los proveedores TIC críticos, como los servicios en la nube."},"topics":["financial-sector","incident-response","supply-chain"],"source_url":"https://eur-lex.europa.eu/eli/reg/2022/2554/oj","archive_snapshot_url":"https://web.archive.org/web/https://eur-lex.europa.eu/eli/reg/2022/2554/oj","license":"eu_reuse","notes":"Si applica dal 17 gennaio 2025.","ingested_from":"manuale","verified_at":"2026-10-26","verified_by":"Claude (seed iniziale, da revisionare in redazione)","editorial_status":"pubblicato","created_at":"2026-10-26","updated_at":"2026-10-26","superseded_by":[],"url":"https://sicurezzacibernetica.it/en/documents/eu-dora-2022-2554/"}}