DORA Critical or Important Functions

DORA defines a critical or important function by impact: the function is critical or important when a defect or failure in its performance would materially impair a financial entity's financial performance, soundness, continuity of services and activities, or continued compliance with authorisation conditions and regulatory obligations. The assessment therefore starts with the business function and its regulated service, not with the vendor catalogue.

Use one classification record per function and licensed activity. A payments incident response platform, trading venue matching engine, securities settlement workflow, client authentication service, or actuarial calculation process may be supported by many ICT services; the function classification should explain why disruption to those ICT services would or would not impair the regulated activity.

A useful DORA classification is a dependency map. For each function, identify the ICT services that support it, the direct ICT third-party service provider, the contractual arrangement reference number, the service location, data-processing and storage locations, and whether the service is concentrated in one provider or a small provider group.

The map should cover intra-group providers as well as external providers. DORA and the contract-policy RTS treat ICT intra-group service providers as ICT third-party service providers for this purpose; internal group sourcing can change the risk profile but does not remove the need for documented oversight.

DORA's register of information is more than a vendor inventory. It is the record that lets a financial entity, group, supervisor, and Lead Overseer see which ICT contracts and providers support which functions. If the criticality decision is separate from the register, the organization will struggle to prove why a contract, subcontractor, incident, or TLPT scope was treated as higher risk.

The register should make the dependency chain reviewable. For ICT services supporting critical or important functions, the register must include subcontractors that effectively underpin those services, including subcontractors whose disruption would impair the service's security or continuity.

When an ICT service supports a critical or important function, DORA expects stronger lifecycle control before and during the contract. The contract policy should define how the entity determines which ICT services support critical or important functions, when that assessment is reviewed, who approves and monitors the contract, what due diligence is required, what assurance is accepted, and when exit planning is tested.

Subcontracting needs its own control record. Before allowing a provider to subcontract ICT services supporting critical or important functions or material parts of them, assess whether the provider can identify and monitor relevant subcontractors, pass through access and inspection rights, maintain continuity through the subcontracting chain, notify material changes in time, and support termination where changes exceed the entity's risk tolerance.

Critical or important function mapping changes operational response. Under the incident classification RTS, incidents affecting ICT services or network and information systems supporting critical or important functions are treated as incidents affecting critical services. Malicious unauthorised access to systems supporting those functions is singled out as a serious reporting concern, and service downtime thresholds are tighter where critical or important functions are involved.

Testing also depends on the classification. DORA requires annual appropriate testing of ICT systems and applications supporting critical or important functions for financial entities other than microenterprises. For entities selected for TLPT, the TLPT scope must cover several or all critical or important functions, identify the underlying ICT systems, processes, technologies, and outsourced or contracted ICT services, and preserve the rationale for including or excluding functions from the test scope.