DORA: Digital Operational Resilience Act Guide
The Digital Operational Resilience Act (DORA) is an EU regulation that establishes a comprehensive framework for digital operational resilience across the financial sector. Effective from January 2025, DORA ensures financial entities can withstand, respond to, and recover from ICT-related disruptions and threats.
What DORA Covers
DORA is built on five pillars:
ICT Risk Management — Financial entities must establish and maintain a comprehensive ICT risk management framework including identification, protection, detection, response, and recovery capabilities.
ICT-Related Incident Management — Entities must classify, manage, and report major ICT-related incidents. Significant cyber threats must also be reported on a voluntary basis.
Digital Operational Resilience Testing — Regular testing of ICT systems including vulnerability assessments, network security tests, and for significant entities, advanced threat-led penetration testing (TLPT) at least every three years.
ICT Third-Party Risk Management — Comprehensive management of risks from ICT third-party service providers, including mandatory contractual provisions, concentration risk monitoring, and exit strategies.
Information Sharing — Voluntary frameworks for sharing cyber threat intelligence among financial entities.
Who DORA Affects
DORA applies to virtually all regulated financial entities in the EU: credit institutions, payment institutions, investment firms, insurance companies, pension funds, crypto-asset service providers, crowdfunding providers, and more. Critically, it also applies to critical ICT third-party service providers (CTPPs) serving these entities — including cloud providers, data analytics firms, and software vendors.
Compliance Approach
- Gap assessment — Map current ICT risk management practices against DORA requirements
- ICT risk framework — Establish or enhance your ICT risk management framework
- Incident management — Implement incident classification, escalation, and reporting processes
- Testing program — Design a resilience testing program meeting DORA's tiered requirements
- Third-party register — Create and maintain a register of all ICT third-party arrangements
- Contract remediation — Update third-party contracts to include DORA-mandated provisions
- Board governance — Ensure management body oversight and accountability for ICT risk
Key Differences from Existing Regulation
DORA harmonizes digital resilience requirements across EU financial services, replacing the patchwork of national guidelines. Its direct applicability as a regulation (not a directive) means consistent requirements across all member states without transposition differences.