DORA

What is DORA?

DORA is an EU regulation, so it applies directly in every member state without national transposition. It makes digital operational resilience a core supervisory topic for finance: firms must be able to withstand, respond to and recover from ICT disruption, including cyber attacks and failures at technology providers.

Who does it apply to?

DORA covers around twenty types of financial entity, including credit institutions, payment and e-money institutions, investment firms, crypto-asset service providers, trading venues, insurers and reinsurers, and others. Smaller and less complex firms can follow a simplified ICT risk framework. It also creates an EU oversight regime for critical ICT third-party providers, such as major cloud providers, which the European Supervisory Authorities oversee directly.

The five pillars

1. ICT risk management: a documented framework owned by the management body, covering identification, protection, detection, response, recovery, backup, learning and communication.
2. Incident management and reporting: classify ICT-related incidents against set criteria and report major ones to the competent authority on strict timelines.
3. Digital operational resilience testing: a risk-based testing programme. Certain entities must also run threat-led penetration testing (TLPT), usually every three years.
4. ICT third-party risk: a register of information on all ICT contracts, mandatory contract clauses, exit strategies and attention to concentration risk.
5. Information sharing: voluntary exchange of threat intelligence between financial entities.

How does it relate to other frameworks?

DORA is the sector-specific law for finance, so it takes precedence over NIS2 for covered entities. Many firms build on ISO/IEC 27001, ISO 22301 and NIST CSF controls, then add DORA’s specific reporting, testing and contract requirements.