§ DORA · Article 25

DORA Article 25: Obligations, Deadlines & Penalties

Regulation (EU) 2022/2554, Article 25 · All obligations · DORA

At a glance

Article 25 of the DORA imposes 3 obligations on central securities depositories and central counterparties, financial entity, microenterprises. At least one obligation carries an explicit compliance deadline.

§ Obligations

All obligations under Article 25

Obligation 1

The digital operational resilience testing programme shall provide for the execution of appropriate tests, such as vulnerability assessments, scans, and penetration testing, in accordance with the criteria set out in Article 4(2). Regulation (EU) 2022/2554, Article 25, Article 25

Obligated entity: financial entity
Sector scope: financial sector
Action required: execute
Deadline: —
Penalty: —

Obligation 2

Central securities depositories and central counterparties shall perform vulnerability assessments before any deployment or redeployment of new or existing applications and infrastructure components, and ICT services supporting critical or important functions. Regulation (EU) 2022/2554, Article 25, Article 25

Obligated entity: central securities depositories and central counterparties
Sector scope: financial sector
Action required: perform
Deadline: before any deployment or redeployment
Penalty: —

Obligation 3

Microenterprises shall perform the tests referred to in paragraph 1 by combining a risk-based approach with a strategic planning of ICT testing, considering the balance between resources and risk factors. Regulation (EU) 2022/2554, Article 25, Article 25

Obligated entity: microenterprises
Size threshold: microenterprise
Sector scope: financial sector
Action required: perform
Deadline: —
Penalty: —

§ Frequently asked

Questions about Article 25

Who must comply with Article 25 of the DORA? +

central securities depositories and central counterparties, financial entity, microenterprises.

What does Article 25 of the DORA require? +

execute perform

What is the compliance deadline for DORA Article 25? +

before any deployment or redeployment

Need a cross-border briefing on DORA Article 25?

Search Fontvera ↵

All EU obligation pages · All DORA articles