[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"framework:dora\u002F11":3},{"item":4,"lessons":16,"controls":18,"related":19},{"family":5,"item":6,"code":7,"title":8,"citations":9,"publisher":10,"summary_md":11,"official_text":12,"official_attribution":12,"official_url":13,"link_label":14,"note":12,"updated_at":15},"dora","11","Article 11","Response and recovery",0,"Regulation (EU) 2022\u002F2554 (Digital Operational Resilience Act)","**What it asks for.** Article 11 requires financial entities to have a comprehensive ICT business continuity policy implemented through ICT response and recovery plans. The aim is to keep critical or important functions running, respond quickly to incidents, limit damage and restore activity.\n\n**In practice.** The entity performs business impact analysis, sets recovery objectives, maintains and regularly tests continuity, response and recovery plans, including scenarios such as cyber attacks and supplier failure, and keeps crisis communication plans. Records of activities during disruptions are kept. Evidence includes the policy, plans, test reports and crisis management records.\n\n**Common gaps.** Plans may not cover severe but plausible scenarios such as a destructive cyber attack. Tests often check individual systems rather than whole business functions.",null,"https:\u002F\u002Feur-lex.europa.eu\u002Flegal-content\u002FEN\u002FTXT\u002FHTML\u002F?uri=CELEX:32022R2554#art_11","Read the official text on EUR-Lex","2026-10-18T15:18:43.664+00:00",{"total":9,"list":17},[],[],[]]