---
title: "Digital resilience in finance"
description: "Digital resilience in finance, family Govern, DORA Art. 9–11"
url: https://www.alt-f1.be/en/table/do/
organization: ALT-F1 SRL, Brussels (VAT BE 0830.560.718)
---

# Digital resilience in finance

Short label: DORA

Family: Govern · DORA Art. 9–11
<a id="meaning"></a>

## Meaning

DORA addresses digital operational resilience in covered financial entities, with requirements concerning systems, incidents, testing and technology suppliers.

<a id="why"></a>

## Why it matters

A financial organisation and its supplier may have different responsibilities under the rules and their contract.

<a id="actions"></a>

## What you can do

Identify your role, relevant systems and supplier agreements. Keep incident records separate from the register of contracts and service providers.

## Services that can help

Device Shield and Web App Shield provide security capabilities and event records. They support relevant work but do not replace the organisation’s full DORA programme.

- [Web App Shield](https://www.alt-f1.be/en/web-shield.md)
- [Device Shield](https://www.alt-f1.be/en/device-shield.md)

## Official reference — DORA Art. 9–11

> 1. For the purposes of adequately protecting ICT systems and with a view to organising response measures, financial entities shall continuously monitor and control the security and functioning of ICT systems and tools and shall minimise the impact of ICT risk on ICT systems through the deployment of appropriate ICT security tools, policies and procedures.
>
> — Regulation (EU) 2022/2554 (DORA), Art. 9(1)

> 1. Financial entities shall have in place mechanisms to promptly detect anomalous activities, in accordance with Article 17, including ICT network performance issues and ICT-related incidents, and to identify potential material single points of failure.
>
> — Regulation (EU) 2022/2554 (DORA), Art. 10(1)

> 1. As part of the ICT risk management framework referred to in Article 6(1) and based on the identification requirements set out in Article 8, financial entities shall put in place a comprehensive ICT business continuity policy, which may be adopted as a dedicated specific policy, forming an integral part of the overall business continuity policy of the financial entity.
>
> — Regulation (EU) 2022/2554 (DORA), Art. 11(1)

**What this reference concerns:** Covered financial entities must protect information and communication technology systems, detect unusual activity and maintain response and recovery arrangements. Supplier contract duties and critical-provider oversight are distinct questions.

[Read the article on EUR-Lex](https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32022R2554#art_9) · Official text, quoted from the Official Journal of the EU