The Cornerstone of DORA

What Is a Critical or Important Function (CIF) Under DORA?

Definition (Article 3(22)), identification criteria, step-by-step methodology, real-world examples — and how to automate CIF management with Resiplan. Every DORA obligation cascades from correctly identifying your CIFs.

Article 3(22) Regulation (EU) 2022/2554 12 min read Updated 2026
Official Definition · DORA Art. 3(22)

Legal Definition of a CIF

A "critical or important function" means a function, the disruption of which would:

Materially impair the financial performance of a financial entity, or
• Impair the soundness or continuity of its services and activities, or
• Whose discontinued, defective or failed performance would materially impair the continuing compliance of a financial entity with the conditions and obligations of its authorisation, or with its other obligations under applicable financial services law. — Regulation (EU) 2022/2554 (DORA), Article 3, point 22
Did you know?

The legal term is "function" — but in practice you map at the service level

DORA uses "function" in Article 3(22). However, per EBA Guidelines on Outsourcing Arrangements (EBA/GL/2019/02 §29), a "function" encompasses "any service, activity, process or task". EU financial institutions therefore identify and operate their CIFs at the business service level — because that is the layer at which the entire DORA cascade actually operates:

Vocabulary used on this site: business service for T1/T2 (revenue/customer-facing or support) · ICT service for T3 (technology layer) · function only inside regulatory citations.

Why the CIF Concept Is the Cornerstone of DORA

DORA does not impose the same obligations on every function. Most requirements — and their intensity — cascade from whether a function is classified as "critical or important". Get CIF identification wrong, and every downstream obligation is wrong too.

Register of Information

Every ICT service supporting a CIF must be flagged in the RoI (ITS 2024/2956) with enhanced attributes.

RTS 2024/1773 →

Contractual Clauses

Stricter mandatory clauses apply to ICT providers supporting CIFs (audit, subcontracting, exit).

Third-Party Risk →

TLPT Scope

Threat-Led Penetration Tests must cover ICT systems supporting CIFs (DORA Art. 26).

TLPT Guide →

Incident Classification

The criticality of services affected (i.e. impact on CIFs) is one of the seven RTS 2024/1772 criteria triggering major incident reporting.

RTS 2024/1772 →

Subcontracting Rules

Stricter subcontracting controls apply to ICT services supporting CIFs: chain mapping, prior authorisation, notification windows and termination rights (RTS 2025/532).

RTS 2025/532 →

ICT Risk Framework

CIF inventory is an input to risk assessment, BCP/DRP, and resilience testing (DORA Art. 5-16).

RTS 2024/1774 →

How to Identify a CIF: The Three Legal Dimensions

DORA Article 3(22) sets out three exhaustive criteria. A function qualifies as CIF when its disruption would materially impair at least one of them. Each criterion can be assessed via quantitative metrics and qualitative judgment.

The 3 legal criteria (Article 3(22), exhaustive)

  1. Material impairment of financial performance — disruption that would meaningfully damage the entity's revenue, costs, capital position or profitability.
  2. Impairment of soundness or continuity — of the entity's services and activities (operational continuity, customer service delivery, market access).
  3. Material impairment of continuing compliance — with conditions and obligations of the entity's authorisation, or with any other obligations under applicable financial-services law.

For each function, the materiality test against these three criteria is supported by both quantitative metrics and qualitative judgment. The two columns below are illustrative inputs — DORA does not prescribe specific thresholds; you must define and document your own.

Quantitative Inputs

  • Revenue share — % of gross income generated by the function
  • Client base impacted — number/percentage of active clients
  • Transaction volume & value — per day/month
  • Recovery Time Objective (RTO) — maximum tolerable disruption
  • Asset under management — for investment services
  • Capital impact — functions affecting Pillar 1 capital

DORA does not prescribe thresholds — set and document your own (e.g. >5% revenue, RTO ≤ 3 days).

Qualitative Inputs

  • Authorisation conditions — function tied to maintaining the licence
  • Customer protection obligations — direct breach of regulated client obligations
  • Service continuity — soundness or continuity of regulated services
  • Substitutability — internal/external replacement difficulty
  • Market integrity / financial stability — systemic implications
  • Compliance dependencies — upstream/downstream regulatory chains

Each input maps back to one of the three Article 3(22) criteria.

Note on reputation: reputational impact is not a primary CIF criterion under DORA Article 3(22). Reputation can act as a leading indicator that one of the three legal criteria may be met (a reputational shock often translates into client losses or supervisory action), but reputational concerns alone are not sufficient to qualify a function as critical or important. Adjacent frameworks like BRRD, EBA Outsourcing Guidelines or ISO 22301 do include reputation explicitly — do not confuse them with DORA.

6-Step Methodology to Identify Your CIFs

A structured approach reviewed by EBA, EIOPA and ESMA in their joint Q&A on DORA.

Run a Business Impact Analysis (BIA) on your service catalogue

Inventory every business service your financial entity delivers — core services (payments, custody, underwriting), support services (treasury, compliance, regulatory reporting). For each, run a BIA producing impact scores (financial, operational, regulatory, reputational, customer) and recovery objectives (RTO, RPO, MTPD). The BIA service catalogue is the input to CIF identification. See dedicated BIA section below ↓

Resiplan imports your BIA (Excel/CSV) and applies the Article 3(22) gate automatically

Apply quantitative scoring

For each function, collect measurable inputs: revenue contribution, client count, transaction volume, AUM. Define institution-specific thresholds (typical: 5% revenue, 10% clients, high-value transaction flows).

Resiplan auto-imports financial data and runs scoring against your thresholds

Apply qualitative assessment

Complement with non-numeric dimensions tied to Article 3(22): authorisation conditions (does this support your licence?), customer protection obligations, service continuity, substitutability, compliance dependencies. Workshop with business heads, legal, risk, compliance.

Resiplan workflow: multi-stakeholder scoring with evidence attachments

Combine and decide

Aggregate quantitative + qualitative scores. Apply your materiality threshold. Document every decision — especially borderline cases where you opted not to classify as CIF (supervisors will ask).

Resiplan produces an auditable CIF register with decision rationale

Link ICT services to CIFs

For every CIF, list the ICT services (internal + third-party) that support it. This data feeds the Register of Information (ITS 2024/2956) and drives which contracts need the stricter DORA clauses.

Resiplan auto-generates the RoI from CIF → ICT service mappings

Board approval and annual review

The management body (board) must formally approve the CIF list. Review at least annually, and whenever a material change occurs (new service, M&A, outsourcing). Keep the approval traceable for supervisors.

Resiplan sends review reminders and tracks board sign-off electronically

Why the service level matters: four operational reasons

"Mapping at the service level" is not a stylistic choice — it is a hard requirement of the DORA cascade. Here is the operational evidence:

1

The Register of Information only knows services

Each row of the RoI (ITS 2024/2956) describes one ICT contractual service, mapped to one or more "functions supported". The xBRL-CSV template has no field for an abstract function — every record must name a concrete service tied to a contract.

2

Incident classification uses "criticality of services"

RTS 2024/1772 criterion 6 is literally "criticality of services affected". If your CIF inventory is at the process or activity level, you cannot answer the criterion at the granularity supervisors expect.

3

DORA contracts regulate services

RTS 2024/1773 (mandatory clauses) and RTS 2025/532 (subcontracting) both regulate the ICT services supporting CIFs — termination rights, sub-contracting authorisation, exit plans. Contracts cannot be signed against abstract functions.

4

BIA produces service-level outputs

Every mature BCM/BIA methodology (ISO 22301, ISO 22317) inventories impacts and recovery objectives at the service level — because that is the granularity at which clients perceive an interruption and at which RTO/RPO/MTPD become measurable.

Methodological backbone

The Business Impact Analysis (BIA): the engine that produces your CIF mapping

Behind every defensible CIF inventory there is a structured Business Impact Analysis (ISO 22317 methodology). DORA does not require a BIA by name, but Article 11(2)(a) explicitly grounds business continuity policies on "impact analysis", and supervisors expect to see the BIA evidence chain when challenging your CIF list. The BIA is therefore the methodological engine that takes you from a service catalogue to a board-approved CIF register.

How each BIA phase feeds DORA

BIA phase Output DORA linkage
Service inventory Catalogue of all business services delivered (internal + external) Pre-requisite to Art. 6 ICT risk framework — you cannot protect what you have not catalogued
Impact assessment Five-axis impact scoring per service: financial · operational · regulatory · reputational · customer Direct input to the Article 3(22) materiality test
Recovery objectives RTO, RPO, MTPD, MBCO per service Art. 11(2)(a) "business continuity policy based on impact analysis" — drives the RTO ≤ 3 days CIF gate
Critical service tier Services ranked by impact severity Becomes the input to the CIF flag and the T1/T2/T3 tier assignment
Recovery testing Continuity tests per service (tabletop, simulation, full failover) Art. 11(6) — testing is mandatory; BIA-derived recovery scenarios feed the test plan

The 7-step BIA → CIF workflow

  1. Build your service catalogue — list every business service delivered, internal or external. Use your operating model or value chain as a starting point.
  2. Score the 5 impact axes per service on a 1–5 scale (financial loss, operational disruption, regulatory breach, reputational harm, customer detriment).
  3. Determine MTPD (Maximum Tolerable Period of Disruption) for each service. This is the trump-card metric for CIF gating.
  4. Apply the CIF gate: a service is CIF if MTPD ≤ your materiality threshold (we illustrate with 3 days) or if any Article 3(22) criterion is breached regardless of MTPD (e.g. authorisation conditions impaired).
  5. Tier each CIF as T1 (Core business service), T2 (Support business service) or T3 (ICT service).
  6. Map ICT dependencies: for each CIF business service (T1/T2), list the ICT services that enable it. This populates the Register of Information.
  7. Reverse propagation: every ICT service supporting a CIF business service inherits the CIF flag and its full obligations stack (contractual clauses, subcontracting controls, TLPT scope).

Resiplan importe votre BIA (Excel/CSV) et applique automatiquement le gate Article 3(22) + le RTO ≤ 3 jours. Votre service catalogue devient un CIF register board-ready en quelques clics.

Try the BIA → CIF bridge

Real Examples: Tier & CIF Status

Illustrative examples across sectors. The Tier column shows the structural classification of the service (T1 = core business service · T2 = support business service · T3 = ICT service); the CIF Status column shows the result of the materiality evaluation (DORA Art. 3(22) + RTO ≤ 3 days). Your actual classification depends on your specific business model and thresholds.

Function Sector Tier Typical RTO CIF Status Why
Core banking / transaction processing Banking T1 < 4h CIF Direct client impact, regulatory authorisation, systemic relevance
Payment initiation (SEPA, instant) Payments T1 < 2h CIF High volume, customer-facing, regulated service
Claims management Insurance T1 < 24h CIF Core to insurance obligations, direct client impact, Solvency II relevance
Custody / safekeeping of assets Investment firms T1 < 4h CIF Client asset protection is a regulated activity
Regulatory reporting (COREP, FINREP) All T2 < 48h CIF Failure = breach of authorisation conditions
AML / KYC screening All T2 < 24h CIF Direct authorisation obligation under AMLD — failure breaches licence conditions
Cloud infrastructure (AWS/Azure) All T3 < 4h CIF (supporting) T3 ICT service supporting T1/T2 business services — flagged in Register of Information
Cybersecurity SOC operations All T3 < 4h CIF (supporting) Detection critical for incident reporting timelines
HR payroll All T2 5–10 days Not CIF RTO > 3 days, no regulatory or client impact
Marketing automation All T3 > 7 days Not CIF Disruption does not materially impair services or compliance
Internal corporate email All T3 3–5 days Depends Borderline — CIF only if email is the primary regulated communication channel
Document management (contracts) All T2 2–7 days Depends CIF if tied to regulatory archiving (RTO < 3 days), otherwise not

The 3-Tier Classification Model: T1 / T2 / T3

DORA defines CIF as a binary concept (Critical OR Important — yes or no). But operational reality requires a structured catalogue. We classify every business service (T1/T2) and every ICT service (T3) into three tiers based on its nature, then evaluate each one against DORA criteria to determine its CIF status. (See the "function vs service" note above on why we tier services, not abstract functions.)

Important: tier ≠ CIF status

The tier classifies what kind of service it is (Core business / Support business / ICT). Whether each tiered service is a CIF under DORA is then determined by a separate materiality evaluation against the three Article 3(22) criteria. We illustrate the methodology using a chosen RTO threshold of 3 days (≤ 72h) — DORA does not prescribe a specific RTO; this is an internal materiality benchmark each institution must define and document.

T1business service

Core Business Services

Revenue-generating & client-facing

Regulated business services that directly deliver the institution's authorised activities to clients and the market.

T2business service

Support Business Services

Internal services enabling T1

Compliance, risk, regulatory reporting, finance — without them, T1 services cannot operate or stay compliant.

T3ICT service

ICT Services

Technology layer underpinning T1 + T2

Cloud, cybersecurity, identity, network, applicatives — the ICT services flagged in your Register of Information.

T1

Core Business Services

Regulated, customer-facing or revenue-generating business services that directly deliver the institution's authorised activities. Failure of a T1 service = immediate impact on clients, market, or licence.

Banking — typical T1
  • Core banking / accounts
  • SEPA / instant payments
  • Card processing
  • Lending platform
  • Custody & safekeeping
Insurance — typical T1
  • Underwriting
  • Claims management
  • Policy administration
  • Actuarial pricing
  • Premium collection
T2

Support Business Services

Internal control, regulatory and operational business services that enable T1 services to operate legally and safely. Failure of T2 = T1 cannot remain compliant or operate at scale.

Banking — typical T2
  • AML / KYC screening
  • Regulatory reporting (COREP/FINREP)
  • Risk management & modelling
  • Treasury operations
  • Compliance & legal
Insurance — typical T2
  • Reinsurance operations
  • Solvency II reporting
  • Compliance & sanctions
  • Finance & accounting
  • Reserving & capital management
T3

ICT Services

The ICT service layer that supports both T1 and T2 business services. This is the layer that populates the DORA Register of Information (ITS 2024/2956). Each T3 ICT service is then linked to the T1/T2 business services it supports — and inherits the CIF flag of any business service it enables.

Internal IT services (T3)
  • Cloud infrastructure
  • Cybersecurity operations
  • Identity & access management
  • Network & connectivity
  • Application platforms
Third-party ICT services (T3)
  • AWS / Azure / GCP
  • Managed SOC providers
  • SaaS core banking / claims
  • Data & analytics platforms
  • External hosting / colocation

From Tier to CIF Status: The Decision Flow

Every T1, T2 and T3 service must pass the same materiality evaluation. Tier defines structure; DORA criteria + RTO threshold determine CIF status.

1
Classify by Tier

Assign every service to T1, T2 or T3 based on its nature.

2
Evaluate DORA Criteria

Apply Article 3(22): materiality of disruption, regulatory impact, soundness of services.

3
Apply Your RTO Threshold

Define your materiality RTO (we illustrate with ≤ 3 days / 72h). Above the threshold = non-CIF, with documented rationale. Not DORA-mandated — your institution sets this.

Result for each service:

CIF — DORA obligations apply Non-CIF — Documented exclusion

Why we use RTO ≤ 3 days as a chosen materiality threshold

DORA does not prescribe a specific RTO threshold for CIF identification; institutions must define and justify their own. We use 3 days (≤ 72h) as a defensible benchmark because: (1) if a service tolerates more than 3 days of disruption without materially impairing the three Article 3(22) criteria, it logically fails the materiality test; (2) it aligns with the DORA major incident reporting cycle (4h → 72h → 1-month); (3) it mirrors PRA SS1/21 "impact tolerance" precedent. A tighter threshold (e.g. 24h) is also acceptable — looser is harder to defend.

Resiplan Module

The CIF Evaluation Module

Don't run this 3-step evaluation in spreadsheets. Resiplan's CIF Evaluation Module catalogues every business service and ICT service by tier, applies DORA Article 3(22) criteria with the RTO ≤ 3 days rule, and produces a board-ready CIF register — auditable, defensible, ready for supervisory review.

Tier Catalogue Engine

Pre-built T1/T2/T3 sector taxonomies (banking, insurance, payments, investment) — drag-and-drop classification.

Guided DORA Evaluation

Walks each tiered service through the Article 3(22) materiality criteria with structured questions — no expert needed.

RTO Threshold Engine

Auto-applies the 3-day rule. Above 72h with no regulatory stake = excluded with documented rationale.

T3 → T1/T2 Cascade

Link ICT services to the business services they support. CIF flag inherits up the chain automatically.

Auto-RoI Generation

The Register of Information (ITS 2024/2956) builds itself from your T3 → T1/T2 mappings. XML-ready.

Audit Trail & Board Sign-off

Every CIF decision is timestamped, attributed, and evidenced. Electronic board approval workflow.

# Sample output: CIF Evaluation Module — your CIF register, auditable per service CIF-PAY-001 · SEPA Credit Transfer · T1 Core · RTO 2h · CIF · Board: 2026-01-15 CIF-CMP-014 · AML/KYC Screening · T2 Support · RTO 24h · CIF · Linked: CIF-PAY-001, CIF-LND-003 CIF-IT-042 · Cloud Infrastructure (AWS) · T3 IT/Digital · RTO 4h · CIF · Supports: CIF-PAY-001, CIF-CMP-014 CIF-OPS-099 · HR Payroll · T2 Support · RTO 7d · Non-CIF · Excluded: RTO > 3d, no regulatory link

What takes 4 hours of workshops becomes 15 minutes of guided clicks — with full audit trail.

Our SaaS · T1/T2/T3 Automation

How Resiplan Implements the T1/T2/T3 Model

Resiplan operationalises the exact model described above: every business service and ICT service is catalogued by tier, then automatically evaluated against DORA Article 3(22) criteria with the RTO ≤ 3 days threshold. No more spreadsheets, no more arbitrary judgement calls — every CIF decision is auditable.

01

Tier classification

Drag-and-drop business services into T1 (Core) and T2 (Support); ICT services into T3, using our pre-built sector catalogue.

02

DORA criteria evaluation

For each tiered service, Resiplan walks you through the Article 3(22) criteria with guided questions — no expert needed.

03

RTO threshold check

Enter the RTO. Resiplan auto-applies the 3-day rule: ≤ 72h = CIF candidate, > 3 days = excluded with documented rationale.

04

T3 → T1/T2 cascade

Each T3 ICT service is linked to the T1/T2 business services it supports. CIF flag inherits up the chain automatically.

05

Auto-generated RoI

The ITS 2024/2956 Register of Information is generated from your T3 → T1/T2 mappings. Submit-ready XML.

06

Board sign-off & review

Electronic board approval, annual review reminders, change-triggered alerts. Full audit trail per CIF decision.

Frequently Asked Questions

Why use a 3-tier (T1/T2/T3) model when DORA only defines binary CIF status?
DORA's binary definition is legally correct but operationally insufficient. A T1 core business service and a T3 ICT service that both qualify as CIF carry very different obligations, RTOs, and supervisory expectations. Tiering provides the structural catalogue on top of which DORA materiality is then evaluated. It also mirrors the architecture supervisors expect to see during inspections: a clean separation between business services (T1/T2) and the ICT services (T3) that support them.
Does DORA mandate a specific RTO threshold for CIF identification?
No. DORA Article 3(22) defines the CIF concept based on materiality of impact (financial performance, soundness/continuity, authorisation compliance) but does not prescribe a quantitative RTO threshold. Each institution must define, justify and document its own. We illustrate the methodology with RTO ≤ 3 days because: (1) it is logically defensible — tolerating > 3 days of disruption without material impact suggests Article 3(22) is not triggered; (2) it aligns with the DORA major incident reporting cycle (4h / 72h / 1-month); (3) it mirrors PRA SS1/21 "impact tolerance" precedent. A tighter threshold (e.g. 24h) is also acceptable; looser is harder to justify.
Are all T1 services automatically CIF? And all T3 automatically not-CIF?
No on both counts. A T1 business service with RTO > 3 days and no regulatory stake is not a CIF. A T3 ICT service that supports T1/T2 business services with RTO ≤ 3 days is CIF-relevant — it gets flagged in your Register of Information and inherits stricter contractual obligations. Tiering classifies the nature of the service; CIF status comes from the materiality evaluation.
Do we need to document every non-CIF function too?
Yes, you must document your full function inventory and the assessment that led you to classify each function as CIF or not. Supervisors will ask for the rationale, especially on borderline cases. The burden of proof that something is not critical is on you.
Is there an official list of CIFs by sector?
No. DORA intentionally provides a principles-based definition (Article 3(22)), not a prescriptive list. Each financial entity must self-assess based on its own business model, materiality, and sector. EBA/EIOPA/ESMA Q&As provide interpretation guidance but no exhaustive enumeration.
How does CIF interact with the Register of Information?
Every ICT third-party service in your Register of Information (ITS 2024/2956) must be flagged with whether it supports a CIF. This flag drives contractual obligations (RTS 2024/1773), subcontracting rules (RTS 2025/532), and oversight intensity. Incorrect CIF tagging propagates errors through your entire DORA compliance chain.
What happens if we classify too few functions as CIF?
Under-classifying CIFs is a major supervisory red flag. Supervisors will challenge your methodology, require remediation, and may issue enforcement actions. Under DORA, fines can reach up to 2% of annual worldwide turnover. It also cascades: under-flagged ICT contracts won't have mandatory DORA clauses.
How often should we review the CIF list?
At least annually, and whenever a material change occurs: new product launch, M&A, outsourcing decision, regulatory change, or significant volume shift. The management body must approve each update.
Can an ICT service itself be a CIF?
Yes — operationally. The legal term in DORA Article 3(22) is "function", but per EBA/GL/2019/02 §29 a function encompasses "any service, activity, process or task". The entire DORA cascade (Register of Information, incident classification criterion 6, contractual obligations, TLPT scope) operates at the service level. On this site we therefore use:
  • business service for T1/T2 (revenue/customer-facing or support)
  • ICT service for T3 (technology layer)
  • function only inside regulatory citations
A T3 ICT service supporting a CIF business service inherits the CIF flag and its full obligations stack.
Why does DORA say "function" but you map at the service level?
DORA's Article 3(22) is principles-based: it defines what makes a function critical, not at which granularity to model it. The bridge comes from EBA Guidelines on Outsourcing Arrangements §29 (EBA/GL/2019/02): "the term 'function' should be understood broadly as any service, activity, process or task". In practice every operational artefact DORA depends on — the Register of Information (ITS 2024/2956), incident classification criterion 6 of RTS 2024/1772 ("criticality of services affected"), contractual clauses (RTS 2024/1773), subcontracting (RTS 2025/532) and TLPT scoping — operates at the service level. Mapping at "process" level (a sub-component of services) makes RoI submission impossible.
Should my Register of Information list services or functions?
Services. The ITS 2024/2956 RoI template requires one row per ICT contractual service, with a column "Functions supported" linking to one or more business services flagged as CIF. You cannot fill the RoI at the abstract function level — every line must name a concrete ICT service tied to a contract, with its provider, jurisdiction, governing law, criticality flag and dependencies.
How does my BIA articulate with the CIF mapping?
The Business Impact Analysis (BIA, ISO 22317) is the methodological backbone. It produces — at the service level — the impact scores (financial, operational, regulatory, reputational, customer) and recovery objectives (RTO, RPO, MTPD) that feed the DORA Article 3(22) materiality test. A service whose MTPD ≤ your chosen materiality threshold (we illustrate with 3 days), or whose disruption breaches an Article 3(22) criterion regardless of MTPD, becomes a CIF. Without a structured BIA, CIF identification rests on subjective judgement and is hard to defend in a supervisory inspection. See the dedicated BIA section ↑

Related Resources

Continue deepening your understanding of DORA's interconnected obligations.

Register of Information Methodology

Build the DORA RoI step-by-step: 9 templates, xBRL-CSV format, CIF flagging, 6-step playbook.

Read Methodology →

TLPT Testing Methodology

5 phases of TIBER-EU Threat-Led Penetration Testing, team setup, timeline, budget.

Read Methodology →

Third-Party Risk Management

Register of Information, contractual clauses, subcontracting under DORA.

Read Guide →

Free Gap Analysis Tool

Assess your DORA compliance across all 5 pillars in 10 minutes.

Start Assessment →

RTS & ITS Overview

All 13 Regulatory and Implementing Technical Standards in one place.

Read Overview →

How Compliant Is Your Institution?

Take our free 5-minute assessment and get an instant DORA compliance score with personalised recommendations.

Get Your Free DORA Score Join Free Monthly Webinar