Digital Operational Resilience Act (DORA)

What it is

DORA — Regulation (EU) 2022/2554 — is the EU's horizontal rulebook for the digital operational resilience of financial entities. It became applicable on 17 January 2025, after a two-year transition.

Five pillars

• ICT risk management. A board-approved ICT risk framework covering identification, protection, detection, response and recovery.
• ICT-related incident reporting. Major incidents classified, reported to the competent authority within strict windows, and analysed for lessons learned.
• Digital operational resilience testing. Regular vulnerability assessments and, for significant entities, Threat-Led Penetration Testing (TLPT).
• ICT third-party risk. Concentration risk on cloud and other ICT service providers; a register of contractual arrangements; oversight of designated Critical ICT Third-Party Providers (CTPPs).
• Information sharing. Voluntary sharing of cyber threat intelligence between financial entities.

Who it applies to

Banks, payment and e-money institutions, investment firms, crypto-asset service providers, central counterparties, central securities depositories, trading venues, fund managers, insurance and reinsurance undertakings, and crowdfunding service providers — among others. Critical ICT Third-Party Providers are also brought under direct EU oversight.