Article 11 of the Digital Operational Resilience Act (DORA) requires financial entities to maintain a documented ICT business continuity policy, including backup, disaster recovery and crisis communication arrangements, tested at least annually.