DORA Policy Templates

Establishes the organization's stance on ICT security and covers general controls for protecting ICT systems and data

Focuses on identifying and mitigating cybersecurity threats, including controls and monitoring practices

Defines roles, responsibilities, and standards for accessing systems and data, including user provisioning, authentication, and privileged access

Ensures data security and confidentiality, covering data encryption, data loss prevention, and data integrity

Sets standards for securing network architecture, firewalls, VPNs, and other network controls

Outlines processes for detecting, assessing, and remediating ICT vulnerabilities and implementing timely security patches

Establishes controls for securing endpoints, including employee devices, servers, and mobile devices

Details planning and testing of procedures to ensure continuity of critical operations and services during disruptions

Provides for the recovery of ICT systems and data in the event of a disaster, including recovery time objectives (RTOs) and recovery point objectives (RPOs)

Outlines procedures for responding to ICT incidents, including roles, responsibilities, and reporting requirements

Defines processes for managing crises, such as a major ICT failure, data breach, or other large-scale disruption

Specifies how internal and external communications are handled in an incident, including customer, regulatory, and stakeholder communications

Details real-time or near-real-time monitoring of ICT systems for unusual activity, security incidents, and performance issues

Establishes regular penetration testing and vulnerability assessments to identify and address ICT weaknesses

Provides guidance for conducting stress tests and scenario analysis to evaluate ICT system resilience under adverse conditions

Specifies requirements for regular audits to ensure compliance with ICT resilience and security policies

Covers internal and external reporting requirements, including reporting to senior management and regulators, incident documentation, and records management

Defines criteria and processes for assessing the risks of engaging third-party ICT providers

Ensures that vendors and suppliers meet the organization's resilience and security standards

Governs outsourced ICT activities, ensuring they are managed effectively and do not pose excessive risk to operational resilience

Details oversight of subcontractors, requiring that they meet the same standards as primary third-party providers

Establishes guidelines for complying with applicable regulations, including DORA and other relevant ICT and cybersecurity standards

Outlines the processes for reporting ICT incidents, outages, and security breaches to relevant regulatory authorities

Ensures compliance with data residency requirements and governs cross-border data transfers

Ensures all employees receive training on ICT security, operational resilience, and incident response

Defines acceptable use of ICT resources and systems, including security expectations for employees

Educates employees on how to identify and report phishing, social engineering, and other cyber threats

Governs the approval, testing, and documentation of changes to ICT systems, ensuring changes do not negatively impact resilience

Establishes processes for maintaining secure and stable ICT configurations, including baselining and configuration control

Ensures secure and resilient software development and deployment practices, including DevSecOps and secure coding standards

Establishes requirements for regular backups of critical data, including frequency, storage, and encryption

Ensures backups are regularly tested to verify data integrity and recovery time objectives

Outlines how policies are created, reviewed, updated, and communicated within the organization

Provides for periodic assessments to evaluate the effectiveness of ICT risk controls

Defines roles and responsibilities for ICT risk management oversight, including the Board, senior management, and risk committees