NorwayDigital Operational Resilience in the Financial Sector: ICT Risk Management and Testing
Lov om digital operasjonell motstandsdyktighet i finanssektoren (DORA-loven) §§ 1, 3 and 4 (Regulation (EU) 2022/2554, Arts. 5 to 16 and 24 to 42)
In force since .
A sector security regimes rule binding private bodies.
- Instrument type
- an act of a legislature
- Obligation class
- Security
As of .
What it requires
- Applies to the financial entities within Regulation (EU) 2022/2554 (DORA), which section 1 of the DORA Act gives the force of law in Norway. Reached by declaring that you provide financial services.
- Meet the ICT risk management requirements of Articles 5, 6, 8, 9(4), 11, 12 and 14 of Regulation (EU) 2022/2554, or the simplified framework of Article 16(1) and (2) where it applies to you (DORA Act, section 4(1)(a) to (h)).
- Meet the Regulation's requirements on digital operational resilience testing and ICT third-party risk (Articles 24, 25(2), 28 and 42(3), DORA Act, section 4(1)(k) to (n)).
These lines are LexLint's reading of the law's text, as of .
If you get it wrong
Penalty structure
Section 4(1) sets an administrative fine of up to NOK 50 million for a breach of the listed provisions of Regulation (EU) 2022/2554.
- Rule
- Fixed only
- As of
- Currency
- NOK
- Fixed cap
- 50,000,000
Who enforces it
Enforcement body
The Financial Supervisory Authority of Norway (Finanstilsynet), the national supervisory authority under the DORA Regulation.
Settledness
- As of
What this law does
Section 1 of the DORA Act gives Regulation (EU) 2022/2554 the force of law in Norway, with the adaptations that follow from the EEA Agreement. Section 4 of the DORA Act covers breaches of the Regulation's provisions on governance, ICT risk management framework, identification of ICT functions, security policies, response and recovery, backup, crisis communication and the simplified framework.
Section 4 of the Act also covers breaches of the Regulation's provisions on general testing requirements, vulnerability assessments, ICT third-party risk management and consideration of risks identified at ICT providers. Section 2 of the Act lets the ministry extend the Act by regulation to financing undertakings, loan intermediaries, debt collection undertakings, real estate brokerage undertakings and parent companies of financial groups.
Section 4 of the DORA Act lets the Financial Supervisory Authority impose an administrative fine of up to NOK 50 million on a person or undertaking that breaches the listed provisions of the Regulation. The Act entered into force on .
When LexLint raises it
When your app profile says your app provides financial services.