Art.11 Response and recovery

Financial entities adopt an ICT business continuity policy within their overall continuity policy and implement it through documented arrangements that keep critical or important functions running, contain and resolve incidents, estimate preliminary impacts, and drive crisis communication and reporting under Articles 14 and 19; they run a business impact analysis, keep ICT response and recovery plans, test, at least once a year and after substantive changes, the continuity and response plans for the systems behind every function, test crisis communication plans, and keep records of activity during disruptions. Entities other than microenterprises additionally have the response and recovery plans reviewed by independent internal audit (Art. 11(3)), include cyber-attack and switchover scenarios in testing (Art. 11(6)), run a crisis management function (Art. 11(7)), and estimate aggregated annual costs and losses of major incidents when the authority asks (Art. 11(10)). Central securities depositories also send continuity test results to the authority (Art. 11(9)). Entities listed in Article 16(1) are outside this Article and follow the simplified framework of Article 16 instead.

Source: DORA (Regulation (EU) 2022/2554), Art.11. The statement above is our statement of the clause, read from the published text and cited so you can check it against the official text, not the instrument verbatim. Open DORA (Regulation (EU) 2022/2554) in the compliance library.

Applies to the financial entities listed in Article 2. Many duties are lighter or absent for microenterprises and for the entities in Article 16(1); each statement says where. Article 19 carries the reporting clocks of Delegated Regulation (EU) 2025/301, Article 5.