[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"framework:dora\u002F3":3},{"item":4,"lessons":16,"controls":18,"related":19},{"family":5,"item":6,"code":7,"title":8,"citations":9,"publisher":10,"summary_md":11,"official_text":12,"official_attribution":12,"official_url":13,"link_label":14,"note":12,"updated_at":15},"dora","3","Article 3","Definitions",0,"Digital Operational Resilience Act","**What it asks for.** The article defines the terms used throughout DORA, including digital operational resilience, ICT risk, ICT-related incident, major ICT-related incident, significant cyber threat, critical or important function, ICT services, ICT third-party service provider, ICT concentration risk, threat-led penetration testing and microenterprise.\n\n**In practice.** Definitions drive scope decisions across the regulation. A critical or important function is one whose disruption would materially impair financial performance, the soundness or continuity of services, or continued compliance with authorisation conditions. ICT services are defined broadly, covering digital and data services provided through ICT systems on an ongoing basis, including hardware support. Organisations should adopt these definitions in internal policies, use them consistently when classifying functions, incidents and contracts, and record the reasoning when deciding whether a function is critical or important.\n\n**Common gaps.** A frequent gap is using internal or legacy definitions of critical services that do not match DORA, which leads to inconsistent contract classification, incomplete registers of information and under-reported incidents.",null,"https:\u002F\u002Feur-lex.europa.eu\u002Flegal-content\u002FEN\u002FTXT\u002FHTML\u002F?uri=CELEX:32022R2554#art_3","Read the article on EUR-Lex","2026-10-18T15:18:43.664+00:00",{"total":9,"list":17},[],[],[]]