DORA
Regulation 2022/2554 on digital operational resilience for the financial sector. Applicable from 17 January 2025.
DORA requires EU financial entities to implement coherent ICT risk management: a register of ICT third-party providers with classification of critical functions, resilience testing, incident reporting, and oversight of concentration risk.
It is a regulation, meaning it applies directly without transposition into national law. It covers banks, investment firms, payment institutions, insurers, and key external ICT providers serving the financial sector. In Poland, supervisory authority is exercised by the Polish FSA (KNF).
A common pitfall is an RTO mismatch: the recovery time written into a vendor contract is longer than the requirement derived from the business impact analysis (BIA). On paper everything looks fine; in a real outage you will not meet the deadline. The vendor register must be kept current and ready for export to the Polish FSA (KNF) at any time.
In practice: see the relevant RealSec module.
The maximum time within which a process or system must be restored to operation after a disruption.
The maximum amount of data that can be lost after a disruption, expressed as a time interval (e.g., the last hour of data).
EU Directive 2022/2555 on a high common level of cybersecurity across the Union. Transposed in Poland via an amendment to the National Cybersecurity System Act.
Compliance that connects.
Terms are the map. RealSec ties them to processes, systems and vendors in one engine.