The Digital Operational Resilience Act harmonises how the EU financial sector manages ICT risk. Unlike a directive, it is directly applicable in every Member State, and it is backed by detailed technical standards that specify templates, criteria and deadlines.
DORA rests on five pillars: ICT risk management, incident management and reporting, resilience testing, third-party risk and information sharing. Requirements are proportionate to each entity's size, risk profile and complexity, but the management body always keeps ultimate responsibility. The aim is simple to state and hard to achieve: keep critical services running through a severe ICT disruption.
Who it applies to
Banking and payments
Credit institutions, payment institutions, electronic money institutions and account information service providers.
Investment and markets
Investment firms, fund managers, trading venues, central counterparties, central securities depositories and trade repositories.
Insurance and pensions
Insurance and reinsurance undertakings, insurance intermediaries and occupational pension funds, with certain exclusions.
Newer financial players
Crypto-asset service providers, crowdfunding service providers and credit rating agencies, among others listed in Article 2.
ICT third-party providers
Providers serving financial entities will find DORA's mandatory clauses in their contracts, and those designated as critical are overseen directly by a European Supervisory Authority.
Key obligations
ICT risk-management framework
A documented framework, reviewed at least once a year, with a digital operational resilience strategy. The management body defines, approves and oversees it. Certain smaller entities may apply a simplified framework.
Incident classification and reporting
Classify ICT-related incidents against common criteria and report major ones: an initial notification within four hours of classification and no later than 24 hours from awareness, an intermediate report within 72 hours and a final report within one month.
Resilience testing
A risk-based testing programme including vulnerability assessments, scans and penetration tests. Entities identified by their competent authority must run threat-led penetration testing (TLPT) at least every three years.
ICT third-party risk
Due diligence before contracting, exit strategies, mandatory contractual provisions and a register of information on all ICT arrangements, with yearly reporting to the authority.
Information sharing
Financial entities may exchange cyber threat intelligence within trusted communities, notifying the authority of their participation.
How we help
Gap analysis
We assess your current framework against DORA and its technical standards, applying proportionality to your real size and risk profile.
Prioritised plan
A roadmap ordered by supervisory exposure and operational risk, with clear owners and the evidence you will need to produce.
Implementation
Framework documentation, incident classification and reporting playbooks, testing programme, register of information and contract review. Our offensive security team runs vulnerability assessments and penetration tests and helps you prepare for TLPT.
Ongoing resilience
Annual framework review, register updates, exercises and board reporting. Our 24/7 SOC, with a target time of under 15 minutes on critical incidents, supports fast detection and classification.
Signs you need to act
- Your register of information is incomplete or lives in spreadsheets nobody owns.
- Contracts with key ICT providers lack DORA's mandatory clauses, such as audit rights or exit plans.
- You could not classify an incident as major and notify the authority within the required hours.
- Your testing programme is limited to a single annual penetration test.
- You are an ICT provider and financial clients are sending you DORA contract addenda.
Frequently asked questions
When did DORA start to apply?
On 17 January 2025. As a regulation, it applies directly across the EU without national transposition, and it is complemented by technical standards adopted by the European Commission.
What are the DORA incident reporting deadlines?
For major ICT-related incidents: an initial notification within four hours of classification and no later than 24 hours from awareness, an intermediate report within 72 hours of the initial notification and a final report within one month of the latest intermediate report. Clients must be informed when their financial interests are affected.
What is TLPT and do we need it?
Threat-led penetration testing simulates real attackers against live production systems. It is mandatory, at least every three years, only for entities identified by the competent authority, but every entity needs a testing programme.
What is the register of information?
A record of all contractual arrangements with ICT third-party service providers, kept at entity and group level, that distinguishes those supporting critical or important functions. The full register must be available to the authority on request.
If DORA applies, does NIS2 apply too?
For financial entities, NIS2 treats DORA as the sector-specific act, so DORA's ICT risk and incident rules take precedence. If your group also runs non-financial activities in NIS2 sectors, those may still fall under NIS2.