Sources

The desk works from a short shelf. Everything else is commentary - including, we are aware, this site.

DORA

• Regulation (EU) 2022/2554 on digital operational resilience for the financial sector (DORA) - Official Journal text on EUR-Lex, applicable from 17 January 2025.
• Regulatory and implementing technical standards under DORA, as published in the Official Journal and linked from the guides they affect.

The European Supervisory Authorities

• European Banking Authority - operational resilience: DORA implementation, registers, and joint examination work.
• European Insurance and Occupational Pensions Authority and European Securities and Markets Authority: sector guidance and joint standards work under DORA.

The UK regime

• Financial Conduct Authority - operational resilience: policy statements, important business services, and impact tolerances.
• Bank of England / Prudential Regulation Authority - operational resilience: the PRA policy statement and supervisory statements.

Good practice, not law

• European Union Agency for Cybersecurity (ENISA) and NIST Computer Security Resource Center: incident response and contingency planning practice, cited as practice, never as a legal duty.