EU DORA First-Batch Delegated Regulations: ICT Risk Management, Incident Classification, and Third-Party Contractual Policy (CDR 2024/1772–1774)

Mechanism

DORA (Art. 15, 17, and 28) empowers the European Commission to adopt delegated regulations specifying the operational substance of three of its five pillars. The first batch — adopted as a package on 13 March 2024 — fills out the compliance obligations that financial entities must actually implement by 17 January 2025.

CDR 2024/1774 — ICT Risk Management Tools, Methods, Processes, and Policies (DORA Art. 15)

The most architecturally significant of the three. Specifies in mandatory technical detail:

• ICT asset identification and classification requirements (including dependency mapping)
• ICT risk appetite frameworks and escalation procedures
• Business continuity and disaster recovery planning standards (RTO/RPO specification)
• Backup and restoration requirements with testing cadence
• Physical and environmental security controls for ICT systems
• ICT-related incident detection and response procedures
• Simplified ICT risk management framework for smaller/simpler financial entities —

a proportionality mechanism allowing reduced documentation burdens for entities below specified size thresholds; reduces the compliance barrier for smaller credit unions, payment firms, and asset managers while keeping the core resilience requirements

CDR 2024/1773 — ICT Third-Party Contractual Policy (DORA Art. 28)

Operationalises DORA's third-party risk pillar at the contract and policy level:

• Financial entities must adopt a written policy governing all ICT third-party contracts

supporting critical or important functions (CIF) — not merely a checklist, but a board-approved strategic document

• The policy must specify criteria for determining which ICT services qualify as CIF,

how concentration risk across providers is assessed, and exit/substitutability plans

• Contractual clauses mandated by DORA Art. 30 (including audit rights, SLAs, data

portability, and termination triggers) must flow from this policy

• Directly constrains cloud hyperscaler relationships: AWS, Azure, GCP contracts for

financial entities must now meet detailed EU-mandated content standards

CDR 2024/1772 — ICT Incident Classification and Materiality Thresholds (DORA Art. 17)

Specifies the exact criteria for classifying an ICT incident as "major" — triggering the mandatory incident-reporting chain to supervisors:

• Multi-criteria classification: clients affected (number and type), data affected,

duration of service disruption, geographical spread, economic impact

• Materiality thresholds are quantitative where possible (e.g., % of transactions

affected, duration in hours)

• Aligns with NIS2 incident-reporting obligations to reduce double-reporting burden
• Standardises what counts as a reportable event across all 22,000 in-scope entities

Downstream implications

• ICT third-party providers (cloud, SaaS, data): The combination of CDR 2024/1773

(contractual requirements) and the CTPP designation track (2025-11-18-eu-dora-ctpp- designation-article-31) creates a two-level oversight architecture: financial entities must impose Art. 30 contract terms on all CIF-supporting third parties, and the most systemic of those third parties (the 19 CTPPs) face direct ESA supervisory authority.

• Smaller financial entities: The simplified framework in CDR 2024/1774 explicitly

carves out a lighter-touch regime — but "simplified" still requires full risk identification, backup testing, and contractual policy. It is a scope reducer, not an exemption.

• Incident reporting calibration: CDR 2024/1772's materiality thresholds set the floor

for what constitutes a notifiable event. Vendors of security/monitoring tools will need to calibrate detection outputs to these thresholds.

• Contract renegotiation pressure: The combined effect of CDR 2024/1773 and the CTPP

regime has already triggered re-negotiation waves in cloud/outsourcing agreements across EU financial entities through 2024-H2; most major hyperscalers had published DORA-aligned contract addenda by Q4 2024.

Open questions

• ESAs have issued supplementary opinions on CDR 2024/1774's simplified framework scope —

whether certain smaller crypto-asset service providers qualify requires regulatory guidance that was still being refined as of early 2025

• Interaction with NIS2 (Directive (EU) 2022/2555) dual-reporting obligations: pending

national transposition differences across EU member states create residual ambiguity for financial entities also classified as essential/important entities under NIS2