Chapter I — General provisions
Subject matter
Summary
Defines the scope and purpose of the regulation, establishing uniform requirements for the security of network and information systems supporting the business processes of financial entities. Sets out ICT risk management, incident reporting, resilience testing, third-party risk, and information sharing as the five core areas.
Key Requirements
- 1
Uniform requirements for ICT security of network and information systems
- 2
Rules on ICT risk management frameworks
- 3
Requirements for ICT-related incident reporting
- 4
Digital operational resilience testing obligations
- 5
ICT third-party risk management framework
Detailed Analysis
Article 1 lays the foundation for the entire DORA regulation by defining its subject matter and scope. The regulation establishes a harmonized set of requirements across the European Union aimed at ensuring that financial entities can withstand, respond to, and recover from all types of ICT-related disruptions and threats.
The article identifies five interconnected areas that form the backbone of digital operational resilience: ICT risk management, incident management and reporting, resilience testing, third-party risk management, and information sharing. These areas are designed to work together as a comprehensive framework rather than standalone requirements.
A key aspect of Article 1 is its emphasis on uniformity. Prior to DORA, ICT risk management requirements for financial services were fragmented across various sectoral directives and national regulations. This article signals the intent to create a single, consistent standard that applies across all types of financial entities, reducing regulatory arbitrage and ensuring a level playing field.
The article also establishes the principle that digital operational resilience is not merely a technical concern but a fundamental requirement for the stability of the financial system. By placing ICT risk management on the same regulatory footing as capital requirements and conduct rules, DORA elevates technology governance to a board-level responsibility.
Ready to automate compliance with Article 1?
Valendir maps every DORA requirement to actionable controls, evidence, and workflows.