DORA-Art12-P1

Article: 12 (1)
Pillar: ICT Risk Management
Regulation Ref: Regulation (EU) 2022/2554, Article 12(1)
Last Reviewed: 2026-01-15

Financial entities shall put in place, maintain and periodically test appropriate ICT business continuity plans, notably with regard to critical or important functions outsourced or contracted through arrangements with ICT third-party service providers.

Evidence Profiles

ICT Business Continuity Plan COMMON

Comprehensive business continuity plan covering ICT systems, including scenario-based recovery procedures, resource requirements, and testing schedules as required by DORA Article 12.

Formats: PDF
Evidence Class: ict-bcp
Availability: COMMON
Update Frequency: annual
Typical Author: Business Continuity Manager
Approval Chain: Business Continuity Manager → COO → Board

Content Sections

Expected Fields

Common Quality Issues

Business impact analysis outdated or incomplete
Recovery procedures not tested for all critical functions
Missing consideration of simultaneous multi-system failures
Third-party provider continuity arrangements not integrated

BCP Test Results Register PARTIAL

CSV register of business continuity plan test executions, including test scenarios, outcomes, identified gaps, and remediation actions.

Formats: CSV
Evidence Class: bcp-test-results
Availability: PARTIAL
Update Frequency: annual
Typical Author: Business Continuity Manager
Approval Chain: Business Continuity Manager → CIO

Content Sections

Expected Fields

Common Quality Issues

Tests limited to tabletop exercises without live failover
Test scenarios do not cover worst-case situations
Remediation actions recorded but not tracked to completion
Missing test coverage for outsourced critical functions

Fact Schemas

ict_bcp_status

Schema ID: fs-ict-bcp-status
Control: DORA-Art12-P1

Valid Ranges

approval_date: within last 18 months
bia_date: within last 12 months
last_test_date: within last 12 months

Related Schemas

JSON Schema

{
  "properties": {
    "all_critical_functions_tested": {
      "type": "boolean"
    },
    "approval_date": {
      "format": "date",
      "type": "string"
    },
    "bcp_version": {
      "type": "string"
    },
    "bia_date": {
      "format": "date",
      "type": "string"
    },
    "critical_functions_count": {
      "minimum": 0,
      "type": "integer"
    },
    "functions_with_recovery_plan": {
      "minimum": 0,
      "type": "integer"
    },
    "last_test_date": {
      "format": "date",
      "type": "string"
    },
    "test_frequency": {
      "enum": [
        "quarterly",
        "semi-annual",
        "annual"
      ],
      "type": "string"
    }
  },
  "required": [
    "bcp_version",
    "approval_date",
    "bia_date",
    "critical_functions_count",
    "last_test_date"
  ],
  "type": "object"
}

bcp_test_results

Schema ID: fs-bcp-test-results
Control: DORA-Art12-P1

Valid Ranges

test_date: within last 12 months
systems_tested_count: should cover all critical systems

Related Schemas

JSON Schema

{
  "properties": {
    "gaps_identified_count": {
      "minimum": 0,
      "type": "integer"
    },
    "remediation_actions_count": {
      "minimum": 0,
      "type": "integer"
    },
    "rpo_achieved": {
      "type": "boolean"
    },
    "rto_achieved": {
      "type": "boolean"
    },
    "scenario_type": {
      "enum": [
        "tabletop",
        "walkthrough",
        "simulation",
        "live_failover"
      ],
      "type": "string"
    },
    "systems_tested_count": {
      "minimum": 1,
      "type": "integer"
    },
    "test_date": {
      "format": "date",
      "type": "string"
    },
    "test_passed": {
      "type": "boolean"
    }
  },
  "required": [
    "test_date",
    "scenario_type",
    "systems_tested_count",
    "test_passed"
  ],
  "type": "object"
}