Is a bank, in Norway

Lov om digital operasjonell motstandsdyktighet i finanssektoren (DORA-loven), §§ 1, 3 and 4 (Regulation (EU) 2022/2554, Arts. 17 to 19) · Read the law's page

• Applies to the financial entities within Regulation (EU) 2022/2554 (DORA), which section 1 of the DORA Act gives the force of law in Norway. Reached by declaring that you provide financial services.
• Put in place the ICT-related incident management process that Article 17 of Regulation (EU) 2022/2554 requires (DORA Act, section 4(1)(i)).
• Report major ICT-related incidents as paragraphs 1, 3 and 4 of Article 19 of the Regulation require (DORA Act, section 4(1)(j)).

Lov om digital operasjonell motstandsdyktighet i finanssektoren (DORA-loven), §§ 1, 3 and 4 (Regulation (EU) 2022/2554, Arts. 5 to 16 and 24 to 42) · Read the law's page

• Applies to the financial entities within Regulation (EU) 2022/2554 (DORA), which section 1 of the DORA Act gives the force of law in Norway. Reached by declaring that you provide financial services.
• Meet the ICT risk management requirements of Regulation (EU) 2022/2554. Section 4(1)(a) to (h) of the DORA Act names Articles 5, 6, 8, 9(4), 11, 12 and 14, and the simplified framework of Article 16(1) and (2) where it applies to you, as the provisions whose breach can draw a fine.
• Meet the Regulation's requirements on digital operational resilience testing and ICT third-party risk (Articles 24, 25(2), 28 and 42(3), DORA Act, section 4(1)(k) to (n)).

Lov om digital sikkerhet (digitalsikkerhetsloven), §§ 7 and 10 · Read the law's page

• Applies to providers of essential societal services in the energy, transport, health, water supply, banking, financial market infrastructure and digital infrastructure sectors (reached by declaring that you operate an essential service), and to providers of online marketplaces, online search engines and cloud services. A bank or health provider among them is also reached by declaring that you provide financial services or handle health records.
• A provider of digital services with fewer than 50 employees and an annual turnover or balance sheet not above EUR 10 million is outside the digital-service security duty (digitalsikkerhetsforskriften section 2, as the National Security Authority's guide states it).
• Carry out a risk assessment of the network and information systems you use to deliver the service (sections 7 and 10).
• Put in place appropriate and proportionate technical and organisational security measures that together secure a level of security adapted to the risk (sections 7 and 10).
• Put in place proportionate measures to prevent, detect and reduce the consequences of incidents, so that delivery of the service can be maintained (sections 7 and 10).

Lov om digital sikkerhet (digitalsikkerhetsloven), §§ 8 and 11 · Read the law's page

• Applies to providers of essential societal services in the energy, transport, health, water supply, banking, financial market infrastructure and digital infrastructure sectors, and to providers of online marketplaces, online search engines and cloud services. The essential-service classes are reached by declaring that you operate an essential service, provide financial services or handle health records.
• Notify the body the King designates, without undue delay and regardless of confidentiality duties, of incidents that significantly affect the delivery of an essential societal service (section 8) or a digital service (section 11).
• As an essential-service provider, send the first notice within 24 hours of becoming aware of the incident, an update within 72 hours, and an incident report within one month of the first notice (digitalsikkerhetsforskriften section 17, as the National Security Authority states it).
• As a digital-service provider, the 24-hour, 72-hour and one-month deadlines do not apply; notify without undue delay (section 11). A provider with fewer than 50 employees and an annual turnover or balance sheet not above EUR 10 million is outside the notification duty, as the National Security Authority's guide states it.