DORA Business Continuity and Disaster Recovery: Articles 11-12 Guide for 2026

In this article ↓

1. DORA BCDR in one table
2. What Article 11 requires
3. What Article 12 requires
4. Where BCDR sits in DORA
5. Critical or important functions
6. Evidence checklist
7. Testing scenarios
8. Incident reporting connection
9. Third-party BCDR
10. Microenterprises and proportionality
11. Common mistakes
12. 90-day BCDR cleanup plan
13. FAQ
14. How does DORA BCDR differ from traditional BCDR?
15. Does every financial entity need TLPT?
16. How often should BCDR be tested?
17. Is ISO 27001 enough for DORA BCDR?
18. Related reading
19. Primary sources

Last reviewed: 29 April 2026

DORA business continuity and disaster recovery is not only an IT recovery topic.

Under DORA, BCDR is part of the financial entity's digital operational resilience framework. It should connect to:

• critical or important functions;
• ICT risk management;
• incident response;
• resilience testing;
• ICT third-party risk;
• management-body oversight.

In 2026, the supervisory question is simple:

Can the financial entity prove that critical or important services can be restored, not just that a continuity policy exists?

DORA BCDR in one table

What Article 11 requires

Article 11 focuses on response and recovery. The financial entity must have an ICT business continuity policy as part of the overall business continuity policy. The policy should cover the continuity of critical or important functions and the procedures for response, recovery and restoration.

The common gap is that the BCP exists but has never been tested against a realistic ICT disruption involving technology, operations, compliance and a critical provider.

What Article 12 requires

Article 12 focuses on backup, restoration and recovery. The entity needs backup policies and procedures, restoration and recovery procedures and methods, and appropriate ICT capacities to meet business needs.

The test is not "did the backup run?"

The test is:

Can the service be restored within the required objective and with data integrity intact?

Where BCDR sits in DORA

BCDR sits across several DORA pillars:

This is why BCDR should not be maintained as a standalone IT document. It should be part of the ICT risk operating model.

Critical or important functions

DORA BCDR should start with critical or important functions, not with a generic server list.

For any critical or important function, the entity should be able to trace the chain:

1. business impact analysis;
2. asset inventory;
3. supplier dependency;
4. recovery plan;
5. test result;
6. management report.

Evidence checklist

Testing scenarios

DORA testing should be risk-based and proportionate. For BCDR, the best scenarios are service-chain scenarios.

Each scenario should produce findings, owners and retest dates. A tabletop without actions is weak evidence.

Incident reporting connection

BCDR and incident reporting should be connected. A disruption that activates continuity or recovery procedures may also require DORA incident classification.

For major ICT-related incidents, the current DORA technical standards use staged reporting:

• initial notification within 4 hours after classification as major and no later than 24 hours after detection or awareness;
• intermediate report no later than 72 hours from the initial notification;
• final report no later than 1 month from the latest intermediate report.

See DORA Incident Reporting 2026 for the detailed timeline.

Third-party BCDR

Outsourced ICT services must be part of BCDR planning. A financial entity cannot show resilience if a critical provider is absent from tests, contracts and exit assumptions.

The Register of Information should not be separate from BCDR. It should help identify which providers support critical functions and what recovery assumptions depend on them.

Microenterprises and proportionality

Proportionality changes depth, not the need for resilience. Smaller entities may use lighter artefacts, but they still need credible continuity, recovery and evidence.

Common mistakes

90-day BCDR cleanup plan

FAQ

How does DORA BCDR differ from traditional BCDR?

DORA ties BCDR to ICT risk management, critical or important functions, incident reporting, resilience testing and ICT third-party risk. The evidence standard is operational: the entity must show plans were tested and findings were closed.

Does every financial entity need TLPT?

No. Threat-led penetration testing under Article 26 applies to financial entities identified by competent authorities under the relevant criteria. All entities need proportionate resilience testing, but TLPT is not universal.

For scope, roles and evidence, see DORA TLPT: 2026 Guide to Threat-Led Penetration Testing.

How often should BCDR be tested?

ICT business continuity and response/recovery plans should be tested at least yearly and after material changes or significant incidents. The test programme should be proportionate to the entity's risk profile.

Is ISO 27001 enough for DORA BCDR?

No. ISO 27001 can support the control environment, but DORA-specific evidence is still needed: critical-function mapping, DORA incident classification, Article 30 provider controls, Register of Information links and DORA resilience testing.

DORA by competent authority

DORA applies as EU law, but day-to-day reporting, evidence and supervisory dialogue runs through your National Competent Authority (NCA). Pick the jurisdiction-specific guide that matches your authorisation:

Jurisdiction	DORA competent authority	Guide
Cyprus	CBC	Cyprus guide →
Denmark	Finanstilsynet	Denmark guide →
Estonia	Finantsinspektsioon	Estonia guide →
France	ACPR	France guide →
Germany	BaFin	Germany guide →
Ireland	Central Bank of Ireland	Ireland guide →
Italy	Banca d'Italia	Italy guide →
Latvia	Latvijas Banka	Latvia guide →
Lithuania	Lietuvos bankas	Lithuania guide →
Luxembourg	CSSF	Luxembourg guide →
Malta	MFSA	Malta guide →
Netherlands	DNB	Netherlands guide →
Spain	Banco de España	Spain guide →
Sweden	Finansinspektionen	Sweden guide →

See the DORA National Competent Authorities selected-jurisdictions hub for the full directory and the difference between NCAs and the EU ESAs (EBA, ESMA, EIOPA).

Related reading

• DORA Incident Reporting 2026: Timeline, Classification and Evidence
• DORA Requirements in 2026: Operating Controls and Evidence Checklist
• DORA Register of Information: 2026 Guide for ICT Third-Party Risk
• DORA ICT Risk Register Template: 2026 Guide for Financial Entities
• 7 DORA Compliance Mistakes EU Financial Firms Still Need to Fix in 2026

Primary sources

• Regulation (EU) 2022/2554 — DORA, EUR-Lex
• European Banking Authority — Digital Operational Resilience Act
• EBA — Regulatory Technical Standards on the ICT risk management framework
• EBA — Joint Technical Standards on major incident reporting