ESAs joint consultation on second batch of policy mandates under the Digital Operational Resilience Act

Through DORA the ESAs are mandated to jointly develop a total of 13 policy instruments, presented in two batches. This second batch comprises the following:

• RTS and ITS on content, timelines and templates on incident reporting
• GL on aggregated costs and losses from major incidents
• RTS on subcontracting of critical or important functions
• RTS on oversight harmonisation
• GL on oversight cooperation between ESAs and competent authorities
• RTS on threat-led penetration testing (TLPT)

Further information on the draft policy products can be found in the introductory note.

Consultation process

Comments on this consultation can be sent to the ESAs via the consultation page. Please note that the deadline for the submission for comments is 4 March 2024. All contributions received will be published following the end of the consultation, unless requested otherwise.