01
Open ↗Regulation (EU) 2022/2554 — DORA
The core EU framework for digital operational resilience in the financial sector.
Curated source collection
Useful links & official resources
Browse the 22 sources collected in the workshop links handout. Open official legislation, guidance, reporting resources and related references.
About these links
The list consolidates sources cited in the 12 Practical Guides. External material can be updated after preparation. EU materials support the fictional EU case; local Albanian supervisory requirements must be checked separately.
22 shown
02
Open ↗Commission Delegated Regulation (EU) 2024/1772
Criteria for classifying ICT-related incidents and cyber threats.
03
Open ↗Commission Delegated Regulation (EU) 2025/301
Content and timelines for major ICT-related incident reporting.
04
Open ↗Commission Implementing Regulation (EU) 2025/302
Standard forms, templates and procedures for major incident reports.
05
Open ↗Directive 2013/36/EU — Capital Requirements Directive (CRD)
EU framework for banking supervision and management-body requirements.
06
Open ↗Commission Delegated Regulation (EU) 2024/1774
Requirements for ICT risk management tools, methods, processes and policies.
07
Open ↗Directive (EU) 2015/2366 — PSD2
Payment-services framework, including strong customer authentication.
08
Open ↗Commission Delegated Regulation (EU) 2018/389
Regulatory technical standards for strong customer authentication.
09
Open ↗Commission Implementing Regulation (EU) 2024/2956
Standard templates for DORA registers of information.
10
Open ↗Commission Delegated Regulation (EU) 2024/1773
Policy for ICT contractual arrangements supporting critical or important functions.
11
Open ↗Commission Delegated Regulation (EU) 2025/532
Requirements concerning subcontracting of ICT services supporting critical or important functions.
12
Open ↗Commission Delegated Regulation (EU) 2025/1190
Detailed regulatory technical standards for threat-led penetration testing (TLPT).
13
Open ↗Joint Guidelines on aggregated annual costs and losses (ESAs)
Estimating annual costs and losses caused by major ICT-related incidents.
14
Open ↗EIOPA DORA Q&A — DORA030
Assessment of ICT services, including their interaction with regulated financial services.
15
Open ↗EIOPA DORA Q&A — DORA130
Meaning of the ongoing-basis condition in the definition of an ICT service. Note: the Q&A is marked “Rejected”; see its explanatory answer.
16
Open ↗EIOPA DORA Q&A — DORA215
Resellers, licences and identification of the effective ICT service provider.
17
Open ↗EBA — Preparation of DORA registers of information
Official resource hub for reporting packages, data point model, taxonomy, validation rules and tools.
18
Open ↗EBA / EIOPA / ESMA — Registers of information FAQ (28 March 2025)
Practical answers on preparing and reporting registers of information.
19
Open ↗ISO/IEC 27001:2022 — Information security management
International standard, including communication requirements in clause 7.4. Full text may require purchase.
20
Open ↗GLEIF — Global LEI Index
Reference data for validating Legal Entity Identifiers (LEIs) in register-related workflows.
21
Open ↗European e-Justice Portal — BRIS / Find a company
Business Registers Interconnection System for verifying EU company information and identifiers.
22
Open ↗BaFin — Guidance on the implementation of DORA (PDF)
German supervisory implementation guidance for ICT risk management and ICT third-party risk management; not Albanian supervisory guidance.
No matching links. Try another search.
“Open” takes you to an external site. ISO/IEC 27001 full text may require purchase. The EIOPA DORA130 Q&A is marked “Rejected” and should be read together with its explanatory response.