Law / Ireland

European Union (Digital Operational Resilience) Regulations 2025, ICT Systems and Continuity Duties of Financial Firms

S.I. No. 12 of 2025, regs. 2 to 7

In force since 17 Jan 2025.

A sector security regimes rule binding private bodies.

Private right of action

No

Obligation class

Security, Governance

As of 12 October 2026.

What it requires

• If you manage a UCITS fund, an alternative investment fund, or are a credit institution, investment firm or insurance or reinsurance undertaking in Ireland, have sound control and safeguard arrangements for electronic data processing, including network and information systems set up and managed in accordance with the DORA Regulation (S.I. No. 12 of 2025, regulations 2, 3 and 6).NIST CSF 2.0PR.DS-01
• As a credit institution or investment firm, have contingency and business continuity policies and plans, including ICT business continuity policies and plans and ICT response and recovery plans, established, managed and tested in accordance with Article 11 of the DORA Regulation (regulation 4).NIST CSF 2.0ID.IM-04

These lines are LexLint's reading of the law's text, as of 12 October 2026.

In the frameworks

NIST Privacy Framework

• PR.PO-P7Response plans (Incident Response and Business Continuity) and recovery plans (Incident Recovery and Disaster Recovery) are established, in place, and managed.
• PR.PO-P8Response and recovery plans are tested.

NIST CSF 2.0

• ID.IM-04Incident response plans and other cybersecurity plans that affect operations are established, communicated, maintained, and improved
• PR.DS-01The confidentiality, integrity, and availability of data-at-rest are protected

CIS Controls

• 3.10Encryption of sensitive data as it crosses networks.
• 3.11Encryption of sensitive data where it is stored on servers and applications.
• 6.8Access rights defined by job role, and kept up to date.
• 7.1A documented, reviewed approach to finding and handling weaknesses.

FINOS AIGF

• AIR-PREV-007Legal and Contractual Frameworks for AI Systems
• AIR-PREV-008Quality of Service (QoS) and DDoS Prevention for AI Systems
• AIR-PREV-012Role-Based Access Control for AI Data
• AIR-PREV-014Encryption of AI Data at Rest
• AIR-PREV-017AI Firewall Implementation and Management
• AIR-PREV-020MCP Server Security Governance

1 more

• AIR-DET-001AI Data Leakage Prevention and Detection

ENISA NIS2 guidance

• 2.1Risk management framework
• 3.1Incident handling policy
• 4.1Business continuity and disaster recovery plan
• 6.2Secure development life cycle
• 6.5Security testing
• 6.10Vulnerability handling and disclosure

2 more

• 9.1Cryptography
• 11.2Management of access rights

Our reading of where this law's duties sit in each framework, and in the NIST CSF 2.0, line by line beside each duty above. It never says that running a control meets the law. How we read a framework against the law

CIS Critical Security Controls® (CIS Controls®) v8.1 © Center for Internet Security, Inc. Safeguard numbers are used under a CIS Controls Supporter License; the one-line descriptions beside them are our own, not CIS text.

Who enforces it

When LexLint raises it

When your app profile says your app is a bank, is an insurer or is a securities firm.

Back to the example  ·  Lint your app