Digital Operational Resilience — Practitioner's Handbook

Digital Operational Resilience — Practitioner’s Handbook — Outline

Chapter 1: Scope, Definitions, and Why DORA Exists

1. Why DORA exists
2. Who’s actually in scope
3. Who’s carved out, and why it’s not arbitrary
4. The two definitions everything else depends on
5. A worked example: in scope, confirmed
6. What’s genuinely unresolved here
7. Related material

Chapter 2: The ICT Risk Management Framework — Governance, Not a Document

1. What Article 8 actually asks for
2. Governance and management are not the same job
3. What gets exercised day to day
4. A worked example: who heard, and when
5. What’s genuinely unresolved here
6. Related material

Chapter 3: ICT Incident Classification and Reporting

1. What makes an incident “major” — and where that answer actually lives
2. Three reports, not one deadline
3. The clock, as it was actually adopted
4. A worked example: a question the rulebook leaves open
5. What’s genuinely unresolved here
6. Related material

Chapter 4: Digital Operational Resilience Testing, Including TLPT

1. The baseline: everyone except microenterprises runs a testing programme
2. The advanced tier: threat-led penetration testing
3. Why the tiering matters more than the techniques
4. A worked example: a blind spot, not a failure
5. What’s genuinely unresolved here
6. Related material

Chapter 5: ICT Third-Party Risk Management and the Register of Information

1. Third-party risk is ICT risk, not a side-category
2. The Register of Information, properly scoped
3. Concentration risk: the question most registers never get asked to answer
4. What Article 30 actually puts in the contract
5. A worked example: a failure that isn’t MCC’s own
6. What’s genuinely unresolved here
7. Related material

Chapter 6: Information Sharing

1. A permission, not a requirement
2. Why a voluntary chapter still earns a place in a compliance programme
3. A worked example: getting the substance right and missing the form
4. What’s genuinely unresolved here
5. Related material

Chapter 7: Oversight of Critical ICT Third-Party Providers

1. How a provider actually gets designated
2. What a Lead Overseer can actually do
3. Who pays for all of this
4. A worked example: MCC Crypto as the customer of the risk, not its subject
5. What’s genuinely unresolved here
6. Related material

Chapter 8: Enforcement — Fines and Supervisory Practice

1. What Article 50 actually says — and doesn’t
2. The one place DORA’s own text does set a number
3. Supervisory practice, so far
4. A second correction: the “Joint Executive Committee”
5. A worked example: a verification question aimed at the book itself
6. What’s genuinely unresolved here
7. Related material

Chapter 9: What DORA Assumes About Your Organization

1. The organization DORA imagines
2. The recurring pattern, named plainly
3. A worked example: whether MCC Crypto actually changed
4. What to do if your organization doesn’t fit the assumed shape
5. Where this book leaves things open