DORA DORA-Art.12: Backup policies and procedures, restoration and recovery

Financial entities document backup policies (scope of data and minimum backup frequency set by criticality or confidentiality) and restoration and recovery procedures, set up backup systems whose activation does not weaken security, and test backup and restoration periodically. When restoring with their own systems they restore onto ICT systems kept separate, both physically and logically, from the source system. Recovery time and recovery point objectives are set per function, and integrity checks and reconciliations follow any recovery. Entities other than microenterprises keep redundant ICT capacity; microenterprises decide on redundancy from their risk profile (Art. 12(4)). Further duties apply only to specific entity types: central counterparties must be able to recover every transaction in progress when the disruption hit, data reporting service providers keep backup and restoration facilities, and central securities depositories keep a geographically distant secondary processing site (Art. 12(3) and (5)). Entities listed in Article 16(1) are outside this Article and follow the simplified framework of Article 16 instead.