DORA Regulation Terminology for Confluence
Your ICT risk policy says “major incident” but your incident response plan says “significant disruption” — DORA defines these differently, and your competent authority can flag it on inspection. Manage DORA terms in Confluence with version control and proof of who approved each one.
What Is DORA?
Regulation (EU) 2022/2554 — the Digital Operational Resilience Act — establishes a comprehensive framework for ICT risk management across the EU financial sector. DORA has applied since January 17, 2025, meaning all in-scope financial entities must now comply.
DORA covers a broad range of financial entities:
- Banks and credit institutions
- Insurance and reinsurance undertakings
- Investment firms and fund managers
- Crypto-asset service providers (CASPs)
- Payment institutions and electronic money institutions
- Credit rating agencies
- Crowdfunding service providers
- Central securities depositories, trade repositories, and trading venues
Unlike a directive, DORA is a regulation — it applies directly in all EU member states without national transposition. The terminology it introduces is legally binding as written.
The DORA Terminology Challenge
DORA introduces specific ICT risk management terminology that finance teams, IT teams, and third-party providers should govern consistently. When your ICT risk management framework uses different language than your incident reporting procedures — or your third-party contracts use different terms than your register of information — that can become a compliance gap your competent authority may flag on inspection.
Terms that consistently cause confusion under DORA:
- “ICT-related incident” vs “major ICT-related incident” vs “significant cyber threat” (each triggers different reporting obligations)
- “ICT third-party service provider” vs “critical ICT third-party service provider” (different oversight regimes)
- “Digital operational resilience testing” vs “threat-led penetration testing” (different scope and requirements)
- “ICT risk” vs “concentration risk” (overlapping but distinct concepts)
- “Subcontracting” (Art. 30(2)(a) / RTS 2024/1773) vs direct ICT service provision (contractual and oversight implications)
DORA Terminology — Five Pillars
The DORA terminology landscape, organized by the five pillars of the regulation:
ICT Risk Management (8 terms)
Incident Reporting (6 terms)
Digital Operational Resilience Testing (5 terms)
Third-Party Risk Management (6 terms)
Governance & Oversight (5 terms)
| DORA Pillar | Terms | Examples |
|---|---|---|
| ICT Risk Management | 8 | ICT Risk, ICT System, ICT Asset, Digital Operational Resilience, Business Continuity Plan |
| Incident Reporting | 6 | ICT-Related Incident, Major ICT-Related Incident, Significant Cyber Threat, Root Cause Analysis |
| Resilience Testing | 5 | TLPT, Vulnerability Assessment, Scenario-Based Testing, Red Team Testing |
| Third-Party Risk | 6 | ICT Third-Party Service Provider, Critical Provider, Concentration Risk, Exit Strategy |
| Governance & Oversight | 5 | Management Body, Lead Overseer, Joint Examination Team, Information Sharing |
Free DORA Terminology Packet
30 ICT risk, incident, testing, third-party, and governance terms. Submit your email and the packet is delivered to your inbox.
Who Does DORA Apply To?
DORA covers 20 categories of financial entities (Article 2(1)(a)-(t)). If your organization falls into any of these categories, you must comply with DORA’s ICT risk management, incident reporting, resilience testing, and third-party risk requirements:
| Entity Type | DORA Relevance |
|---|---|
| Credit institutions (banks) | Full scope — ICT risk management, incident reporting, TLPT, third-party oversight |
| Insurance & reinsurance undertakings | Full scope — all five DORA pillars apply |
| Investment firms | Full scope — proportionality applies based on size and complexity |
| Crypto-asset service providers (CASPs) | Full scope — included in DORA via MiCA Art. 152 amendment (effective 30 December 2024) |
| Payment institutions | Full scope — including electronic money institutions |
| Credit rating agencies | Full scope — ICT risk management and incident reporting |
| Crowdfunding service providers | Full scope — authorized under Regulation (EU) 2020/1503 (ECSPR); in DORA scope per Art. 2(1)(p) |
| Central securities depositories | Full scope — critical market infrastructure |
| Trading venues & CCPs | Full scope — systemic importance triggers enhanced testing |
| ICT third-party service providers | Oversight framework — critical providers subject to Lead Overseer regime |
DORA-Ready Terminology Management
Stop managing ICT risk definitions in spreadsheets that don’t have audit trails. Install the DORA starter pack, review and approve your terms, then scan your documentation. Review our transparent app limitations for full details on what we do and don’t cover. Last verified: 2026-07-01.
Evaluate in Confluence Get Free Packet