DORA

DORA Statement

The EU Digital Operational Resilience Act (Regulation (EU) 2022/2554, “DORA”) sets operational-resilience requirements for financial entities and for the ICT providers that serve them. This statement explains how Employee Zero supports financial-entity clients that are in scope of DORA. It applies only to those clients and does not change the terms for clients outside the EU financial sector.

How we support DORA

Where we act as an ICT third-party service provider to an in-scope financial entity, we support our client’s DORA obligations, including by agreeing the contractual provisions DORA expects (Article 30), such as:

• clear descriptions of the services and the locations where data is processed
• commitments on accessibility, availability and security
• assistance with ICT-related incidents
• conditions for sub-contracting
• participation in resilience testing
• audit and access rights for the financial entity and the relevant competent authorities
• support on exit and termination

Register of information and incident reporting

We support our client’s register of information and provide the information they need for ICT incident reporting.

Risk management and continuity

Our ICT risk-management and business-continuity practices are summarised in our Trust Centre.

Scope

This statement applies only to EU financial-entity clients in scope of DORA. If you are unsure whether it applies to you, please contact us.