Independent certification body · Registered in Republic of Estonia Standards Register Contact
European Digital
Certification Agency Building trust in European technology
Verify a certificate Apply for certification

EDCA-P10 · Governed by EDCA-STD-06

Operational Resilience Certification

An assessment of an organisation whose failure would be felt by its customers rather than only by itself. It examines dependency mapping, recovery capability actually demonstrated rather than merely stated, testing, concentration risk, and the information a customer needs in order to oversee the organisation as a supplier.

What this certification is not

This certification is an assessment against the Agency's own standard. It is not a designation as a critical ICT third-party service provider under Regulation (EU) 2022/2554, not oversight by any European Supervisory Authority, and not a substitute for the contractual arrangements and risk assessment a financial entity must itself carry out in respect of its ICT providers.

Scope of assessment

The scope is agreed in writing before the assessment begins and is printed on the certificate. A certificate says nothing outside its scope.

  • Named services supplied to customers and the commitments made about them
  • Dependencies on infrastructure, providers and key personnel
  • Recovery objectives and demonstrated recovery capability
  • The testing regime and what it has actually exercised
  • Information and rights given to customers for their own oversight

What is examined

Each area below is assessed against the requirements of EDCA-STD-06, Operational Resilience and Continuity, version 1.2.

  • Mapping of critical services and their dependencies
  • Recovery time and recovery point objectives, and evidence they are met
  • Continuity and disaster recovery testing against defined scenarios
  • Concentration risk and exit planning
  • Incident classification, notification timing and customer communication
  • Sub-contracting and the dependency chain beyond the immediate supplier
  • Contractual and technical information made available to customers

Programme particulars

Programme code
EDCA-P10
Governing standard
EDCA-STD-06 — Operational Resilience and Continuity, version 1.2, issued 2 June 2026
Levels available
Level II — EDCA Security Verified
Level III — EDCA Advanced Compliance
Level IV — EDCA Trusted Technology
Typical duration
Eight to fourteen weeks from application to decision.
Surveillance
As required by the level held. See level requirements.

Evidence normally requested

The list is indicative. The evidence request issued after the preliminary assessment is specific to the agreed scope.

  1. Service and dependency map for the assessed scope
  2. Stated recovery objectives and the records of tests against them
  3. Continuity test scenarios and their outcomes
  4. Incident register with classification and notification times
  5. Sub-contractor register and exit plan
  6. The information a customer would need to record about this supplier

Apply for Operational Resilience Certification

Submitting an application costs nothing and commits you to nothing. The Agency will confirm eligibility, propose a scope and issue a fee schedule before any assessment work begins.