Business functions represent the key operational processes and services within your financial entity that rely on ICT systems. DORA requires you to identify which business functions are critical or important and map them to the ICT services and providers that support them.

Business Functions Overview

The business functions page displays your functions in a responsive cards grid layout:

  • 1 column on mobile devices
  • 2 columns on tablets
  • 3 columns on desktop screens

Each card shows the function name, criticality badge, business line, and a brief description. Click any card to open the detail modal.

Creating a Business Function

Click the "Add Function" button to reveal the inline create form at the top of the page. Complete the following fields:

FieldTypeRequiredDetails
Function NameText inputRequiredThe name of the business function. Placeholder: "Core Banking, Payment Processing"
Business LineText inputOptionalThe business line this function belongs to. Placeholder: "Retail Banking, Insurance"
DescriptionTextareaOptionalA detailed description of what this business function entails and its role within the organisation.
Criticality LevelRadio buttonsRequiredThree options:
  • Critical — function whose disruption would materially impair the entity's regulatory obligations, financial stability, or continuity of services (per DORA Art 3)
  • Important — function that significantly supports operations but whose disruption would not cause immediate systemic impact
  • Not Critical — supporting function with limited operational impact if disrupted
A help text link references DORA Art 3 for guidance on classification.
Last Assessment DateDate pickerOptionalThe date this function was last assessed for criticality.
Discontinuation ImpactSelect dropdownOptionalOptions: Not assessed, Low, Medium, High. Indicates the impact if the ICT service supporting this function were discontinued.
RTO (Recovery Time Objective)Text inputOptionalThe maximum acceptable time to restore this function after disruption. Placeholder: "e.g., 4 hours, 24 hours"
RPO (Recovery Point Objective)Text inputOptionalThe maximum acceptable data loss measured in time. Placeholder: "e.g., 1 hour, 0 data loss"
ℹ️
RTO answers the question: "How quickly must we recover?" RPO answers: "How much data can we afford to lose?" These are critical for resilience testing under DORA Art 24-27.

Detail Modal

Clicking a function card opens a detail modal with two modes:

View Mode

The view mode displays:

  • Description — the full function description
  • Metric cards — four small cards showing:
    • Criticality — with colour-coded badge
    • Discontinuation Impact — the assessed impact level
    • RTO — the recovery time objective
    • RPO — the recovery point objective
  • Last Assessment — the date of the most recent assessment
  • Linked Arrangements — a list of contractual arrangements that support this function, showing the contract reference and the provider's display name

Edit Mode

Click the "Edit" button in the modal to switch to edit mode. All fields from the create form are available for modification. Click "Save" to persist changes or "Cancel" to discard them.

Delete

A "Delete" button is available in the modal. Deleting a function will remove it from the register and unlink it from any contractual arrangements.

⚠️
Deleting a business function that is linked to contractual arrangements will not delete the contracts, but the function-to-contract mapping will be removed. This may affect your ESA template B_06.01 export.
💡
Map every critical business function to at least one contractual arrangement. This mapping is essential for demonstrating to regulators that you understand your ICT dependencies.