DORA explained: what financial entities need to know now
What is DORA?
DORA (Regulation (EU) 2022/2554, the Digital Operational Resilience Act) creates a uniform framework for digital operational resilience in the EU financial sector. As a regulation it applies directly; no national transposition is needed. The aim is that financial entities can withstand, respond to and recover from ICT disruptions and cyber attacks.
Who does DORA apply to?
DORA covers around 20 types of financial entities as well as critical ICT third-party providers. For small and non-interconnected investment firms and some other small institutions a simplified framework applies (Art. 16). Details are in the article Who does DORA apply to?
The five pillars of DORA
1. ICT risk management
A documented framework for dealing with ICT risks. The management body bears the responsibility, sets the strategy and oversees implementation.
2. Handling and reporting of incidents
Major ICT-related incidents must be detected, classified and reported to the competent authority, in several staged reports.
3. Digital operational resilience testing
Every entity needs a testing programme. Financial entities designated by the supervisor must additionally carry out threat-led penetration testing (TLPT).
4. ICT third-party risk
Financial entities manage their outsourcing, agree minimum contractual provisions and keep a register of information. Critical ICT third-party providers are subject to EU oversight.
5. Information sharing
Financial entities may exchange threat intelligence among themselves on a voluntary basis.
Reporting of incidents
Major ICT-related incidents must be reported to the competent national authority in stages: an initial notification, an intermediate report and a final report. The exact deadlines are set by regulatory and implementing technical standards (RTS/ITS).
Digital operational resilience testing
Every entity in scope needs a testing programme. Financial entities designated by the supervisor for this purpose (Art. 26(8)) must additionally carry out regular threat-led penetration testing (TLPT). More under DORA resilience testing and TLPT.
Exercising as a mandatory element
Technical tests alone are not enough. DORA also requires that response, recovery and communication plans are tested. That is what tabletop exercises are made for: the team makes decisions under time pressure and works through the reporting paths. At the end there is documented evidence.
Frequently asked questions
Since when does DORA apply?
The DORA Regulation (EU) 2022/2554 entered into force on 16 January 2023 and has applied directly in all member states since 17 January 2025. No national transposition is required.
Who does DORA apply to?
DORA applies to many types of financial entities, from banks, payment service providers and investment firms to insurers and crypto-asset service providers. Added to that are critical ICT third-party providers, which are subject to EU oversight.
Does DORA require exercises?
DORA requires a programme for testing digital operational resilience. Besides technical tests it includes scenario-based tests and the testing of response and recovery plans. Tabletop exercises suit both.
Note: This article is for general information and is not legal advice. The applicable laws and regulations, and the current state of national transposition, take precedence.