UK Regime for Small Firms
The UK regime for small firms: the same service outcome expectation, applied proportionately, with lean governance, supplier dependence and concentration risk in view.
Home / Guides / Page 7
All guides A-Z
258 guides across 20 lines. Each one opens with a service check: the regime reference, the obligation, the start date and who has to act. Page 7 of 7, guides 247 to 258.
UK Regime Lessons from Implementation
Lessons from UK implementation: where firms struggled with service lists, tolerances, maps and testing, and what stronger implementations did differently.
UK Regime Timeline and Deadlines
The UK operational resilience timetable: identification and tolerances first, then remaining within tolerance under severe but plausible scenarios, with ongoing self-assessment.
Vulnerability Scanning and Assessment
What vulnerability scanning and assessment reveal about a firm's ICT systems, why a clean scan is not a clean bill of health, and how findings become fixes.
What Counts as a Major ICT Incident
What makes an ICT incident major under DORA, how the classification criteria work in practice, and why the service effect matters more than the technical fault alone.
What Counts as an Important Business Service
When a service counts as important: the harm, user and substitutability questions that separate a genuinely important service from an ordinary internal process.
What Good Resilience Evidence Looks Like
The marks of evidence a stranger can trust: tied to one service, dated, owned, and produced by running or testing the service rather than describing it.
What Is Operational Resilience
A plain explanation of operational resilience: what it means for an important service, how harm and recovery are judged, and why a patched system can still fail users.
What the Register Records
What the DORA register of information actually records: providers, ICT services, supported functions, contracts, data and locations, linked so each arrangement can be traced end to end.
When a Supplier Becomes Critical
How a supplier becomes critical under DORA: not always by appointment at signing, but by drift, growth and concentration, until a service cannot run or recover without it.
Who must undertake TLPT
Not every financial entity is designated for TLPT under DORA. This guide explains designation, what it means for a firm, and how group and supplier arrangements fit in.
Why Services Not Systems Are the Unit
Why resilience is organised around services rather than systems: a service is what users receive, and a healthy system can still leave users unserved.