NorwayDigital Operational Resilience in the Financial Sector: ICT Incident Management and Reporting
In force since .
A vulnerability and incident reporting rule binding private bodies.
- Instrument type
- an act of a legislature
- Obligation class
- Reporting
As of .
What it requires
- Applies to the financial entities within Regulation (EU) 2022/2554 (DORA), which section 1 of the DORA Act gives the force of law in Norway. Reached by declaring that you provide financial services.
- Put in place the ICT-related incident management process that Article 17 of Regulation (EU) 2022/2554 requires (DORA Act, section 4(1)(i)).
- Report major ICT-related incidents as paragraphs 1, 3 and 4 of Article 19 of the Regulation require (DORA Act, section 4(1)(j)).
These lines are LexLint's reading of the law's text, as of .
If you get it wrong
Penalty structure
Section 4(1) sets an administrative fine of up to NOK 50 million for a breach of the listed provisions of Regulation (EU) 2022/2554.
- Rule
- Fixed only
- As of
- Currency
- NOK
- Fixed cap
- 50,000,000
Who enforces it
Enforcement body
The Financial Supervisory Authority of Norway (Finanstilsynet), the national supervisory authority under the DORA Regulation.
Settledness
- As of
What this law does
Section 1 of the DORA Act gives Regulation (EU) 2022/2554 the force of law in Norway, with the adaptations that follow from the EEA Agreement. Section 4 of the DORA Act covers breaches of Article 17 of the Regulation on the process for managing ICT-related incidents. Section 4 of the Act also covers breaches of paragraphs 1, 3 and 4 of Article 19 of the Regulation on the reporting of major ICT-related incidents.
Section 4 of the DORA Act lets the Financial Supervisory Authority impose an administrative fine of up to NOK 50 million on a person or undertaking that breaches the listed provisions of the Regulation. The Act entered into force on .
When LexLint raises it
When your app profile says your app provides financial services.