DORA Article 12: Obligations, Deadlines & Penalties

Financial entities shall develop and document backup policies and procedures specifying the scope of data subject to backup and minimum frequency based on criticality or confidentiality. Regulation (EU) 2022/2554, Article 12, Article 12

Financial entities shall develop and document restoration and recovery procedures and methods as part of their ICT risk management framework. Regulation (EU) 2022/2554, Article 12, Article 12

Financial entities shall set up backup systems that can be activated in accordance with backup policies and procedures, ensuring activation does not jeopardise security or data integrity. Regulation (EU) 2022/2554, Article 12, Article 12

Financial entities shall undertake periodic testing of backup procedures and restoration and recovery procedures and methods. Regulation (EU) 2022/2554, Article 12, Article 12

When restoring backup data using own systems, financial entities shall use ICT systems that are physically and logically segregated from the source ICT system. Regulation (EU) 2022/2554, Article 12, Article 12

Financial entities shall ensure ICT systems used for restoring backup data are securely protected from unauthorised access or ICT corruption and allow timely restoration of services. Regulation (EU) 2022/2554, Article 12, Article 12

Central counterparties shall ensure recovery plans enable the recovery of all transactions at the time of disruption to allow continued operation and settlement on the scheduled date. Regulation (EU) 2022/2554, Article 12, Article 12

Data reporting service providers shall maintain adequate resources and have back-up and restoration facilities in place to offer and maintain their services at all times. Regulation (EU) 2022/2554, Article 12, Article 12

Financial entities, other than microenterprises, shall maintain redundant ICT capacities equipped with resources, capabilities and functions adequate to ensure business needs. Regulation (EU) 2022/2554, Article 12, Article 12

Microenterprises shall assess the need to maintain redundant ICT capacities based on their risk profile. Regulation (EU) 2022/2554, Article 12, Article 12

Central securities depositories shall maintain at least one secondary processing site endowed with adequate resources, capabilities, functions and staffing arrangements to ensure business needs. Regulation (EU) 2022/2554, Article 12, Article 12

The secondary processing site of central securities depositories shall be located at a geographical distance from the primary processing site to ensure a distinct risk profile. Regulation (EU) 2022/2554, Article 12, Article 12

The secondary processing site of central securities depositories shall be capable of ensuring continuity of critical or important functions identically to the primary site or providing necessary service levels. Regulation (EU) 2022/2554, Article 12, Article 12

The secondary processing site of central securities depositories shall be immediately accessible to staff to ensure continuity of critical or important functions if the primary site is unavailable. Regulation (EU) 2022/2554, Article 12, Article 12

Financial entities shall take into account whether a function is critical or important and the potential overall impact on market efficiency when determining recovery time and recovery point objectives. Regulation (EU) 2022/2554, Article 12, Article 12

Financial entities shall ensure that recovery time objectives ensure agreed service levels are met in extreme scenarios. Regulation (EU) 2022/2554, Article 12, Article 12

When recovering from an ICT-related incident, financial entities shall perform necessary checks, including multiple checks and reconciliations, to ensure the highest level of data integrity. Regulation (EU) 2022/2554, Article 12, Article 12

Financial entities shall perform checks when reconstructing data from external stakeholders to ensure all data is consistent between systems. Regulation (EU) 2022/2554, Article 12, Article 12