Reading time: ~ 2 min.

• (EC) N. 1060/2009, commonly known as «Credit Rating Agencies»;
• (EU) N. 648/2012, commonly known as «EMIR», OTC derivatives;
• (EU) N. 600/2014, commonly known as «MIFIR», Markets in Financial Instruments;
• (EU) N. 909/2014, commonly known as «CSDR»;
• (EU) 2016/1011, commonly known as «Benchmark Regulation».

The Digital Operational Resilience Act (DORA) defines a set of requirements to ensure both digital resilience and security especially in the following chapters:

• 📘 I. General Provisions
• 📘 II. ICT Risk Management
• 📘 III. ICT Related Incident Management Process
• 📘 IV. Digital operational resilience test
• 📘 V. Managing of ICT third party risk
• 📘 VI. Information sharing arrengement

• ISO 38500 (Governance)
• ISO 31000 (Risk Management)
• ISO 37301 (Compliance)

The GRC approach provides a useful basis for addressing and integrating the main aspects of:

• ISO 22301 (Resilience and business continuity)
• ISO 27001 (Information security)
• ISO 20000-1 (ICT services; such as: asset and configuration, management, threats and vulnerabilities)
• ISO 27035 (incident and problem management)
• backup and disaster recovery, etc.

To better figure out  the «big picture» about the DORA regulation and the ISO Management Systems according to the suggested GRC approach, take a look at this infographic: