LexLint.ioBeta

Know the law your code answers to.

Law / Finland

Laki Finanssivalvonnasta, Supervision and Sanctions for the Digital Operational Resilience Regulation

38 ja 40 §, Laki Finanssivalvonnasta (878/2008), DORA provisions

In force since .

A sector security regimes rule binding public and private bodies.

Private right of action
No
Obligation class
Security, Governance

As of .

What it requires

  • If you are a financial entity under DORA Article 2(2) supervised by Finanssivalvonta, meet the ICT risk-management duty in DORA Article 16 (Act 878/2008, section 38, first paragraph, item 12).
  • Meet DORA's duties on ICT risk management (Articles 5 to 14), ICT-related incident management, classification and reporting (Articles 17 to 19), digital operational resilience testing (Articles 24 to 27) and management of ICT third-party risk (Articles 28 to 30) (section 40, second paragraph, item 13).

These lines are LexLint's reading of the law's text, as of .

In the frameworks

NIST Privacy Framework
  • PR.PO-P7Response plans (Incident Response and Business Continuity) and recovery plans (Incident Recovery and Disaster Recovery) are established, in place, and managed.
NIST CSF 2.0
  • GV.OC-03Legal, regulatory, and contractual requirements regarding cybersecurity - including privacy and civil liberties obligations - are understood and managed
CIS Controls
  • 3.2A maintained catalogue of the sensitive data the enterprise holds and where it sits.
  • 8.2Turning on and gathering logs from the enterprise's systems.
FINOS AIGF
ENISA NIS2 guidance
  • 1.1Policy on the security of network and information systems
  • 1.2Roles, responsibilities and authorities
  • 2.2Compliance monitoring
  • 3.2Monitoring and logging
  • 12.4Asset inventory

Our reading of where this law's duties sit in each framework. It never says that running a control meets the law. How we read a framework against the law

CIS Critical Security Controls® (CIS Controls®) v8.1 © Center for Internet Security, Inc. Safeguard numbers are used under a CIS Controls Supporter License; the one-line descriptions beside them are our own, not CIS text.

Who enforces it

Enforcement body

Finanssivalvonta, the Finnish Financial Supervisory Authority, which section 50 a, item 18 makes the competent authority under Article 46 of the DORA Regulation.

Settledness

As of

What this law does

Drafted with AI

Drafted with AI from the cited sources under the direction of UnGovr staff. UnGovr holds editorial responsibility for this page. How this site is made

Research summary

Legal information, not legal advice. This is LexLint's own research summary of a public legal source, and it creates no attorney-client relationship. For decisions that matter, consult qualified counsel in the relevant jurisdiction. About LexLint

Finanssivalvonta, the Finnish Financial Supervisory Authority, acts as the competent authority under Article 46 of the DORA Regulation (Regulation (EU) 2022/2554) (section 50 a, item 18). A third party that is an ICT third-party service provider under DORA Article 3(19) is another participant in the financial markets under the Act (section 5, item 42). Failing or breaching the ICT risk-management duty in DORA Article 16 is a ground for an administrative fee (rikemaksu) (section 38).

Breach by a financial entity of DORA's duties on ICT risk management (Articles 5 to 14), ICT-related incident management, classification and reporting (Articles 17 to 19), resilience testing (Articles 24 to 27) and third-party ICT risk (Articles 28 to 30) is a ground for a penalty payment (seuraamusmaksu) (section 40).

Finanssivalvonta may pass information on ICT-related disruptions and threats to the Finnish Transport and Communications Agency for their cooperation on managing ICT-related disruptions (sections 3 f and 71). The DORA provisions were added by Act 610/2024, in force from .

When LexLint raises it

When your app profile says your app provides financial services.

Back to the example  ·  Lint your app