DORA explained: what the Digital Operational Resilience Act requires

Digital operational resilience for the financial sector

Banks, insurers, investment firms, and payment providers now run almost entirely on digital systems, and many of those systems depend on a small number of technology providers.

A single cyberattack or outage can disrupt services for millions of customers and spread quickly across the financial system.

To address this, the European Union introduced the Digital Operational Resilience Act (DORA), a single set of rules for how financial entities manage ICT risk.

This guide explains what DORA is, who it applies to, its five core pillars, and how organizations can strengthen their compliance.

What is DORA?

DORA, formally Regulation (EU) 2022/2554, is an EU regulation on digital operational resilience for the financial sector.

It entered into force on 16 January 2023 and has applied since 17 January 2025.

Because DORA is a regulation, it applies directly in every EU Member State. It is supported by detailed technical standards that specify how many of its requirements must be met in practice.

Digital operational resilience means an organization’s ability to build, assure, and review its operational integrity and reliability, so that it can withstand, respond to, and recover from ICT-related disruptions.

Who does DORA apply to?

DORA applies to around twenty types of financial entities, including:

• Credit institutions
• Payment and electronic money institutions
• Investment firms and trading venues
• Crypto-asset service providers
• Central securities depositories and central counterparties
• Insurance and reinsurance undertakings
• Fund managers and institutions for occupational retirement provision
• Credit rating agencies and crowdfunding service providers

DORA also reaches the ICT third-party service providers that financial entities depend on, such as cloud, software, and data providers, through contractual requirements and a dedicated oversight framework.

The rules apply proportionately. Smaller and less complex entities can follow a simplified ICT risk management framework.

The five pillars of DORA

1. ICT risk management

Financial entities must have a sound, comprehensive, and well-documented ICT risk management framework. It must cover identifying ICT assets and risks, protection and prevention, detection of anomalies, response and recovery, backup policies, learning from incidents, and communication.

The management body holds ultimate responsibility for managing ICT risk and must define, approve, and oversee the framework.

2. ICT-related incident management and reporting

Entities must detect, manage, classify, and record ICT-related incidents. Major incidents must be reported to the competent authority in stages: an initial notification, an intermediate report, and a final report, within deadlines set by the technical standards. The initial notification is due within hours of an incident being classified as major.

3. Digital operational resilience testing

Entities must run a risk-based testing program, including vulnerability assessments, scenario-based tests, and other appropriate tests. Certain entities identified by their authorities must also carry out threat-led penetration testing (TLPT) at least every three years.

4. ICT third-party risk management

Financial entities remain fully responsible for compliance even when they outsource. DORA requires them to manage third-party risk across the contract life cycle, maintain a register of information on all ICT third-party arrangements, and include specific provisions in their contracts, such as service levels, audit rights, and exit strategies.

5. Information sharing

DORA encourages financial entities to share cyber threat information and intelligence with each other within trusted communities, to improve awareness and resilience across the sector.

Oversight of critical ICT providers

DORA created an EU-level oversight framework for critical ICT third-party service providers (CTPPs) whose failure could affect financial stability.

In November 2025, the European Supervisory Authorities published the first list of designated CTPPs, including major cloud and technology providers. These providers are now overseen by a Lead Overseer, which can request information, carry out inspections, and issue recommendations.

DORA, NIS 2, and international standards

DORA is sector-specific legislation. For financial entities in its scope, DORA’s ICT risk management and incident reporting rules take precedence over the corresponding NIS 2 requirements.

International standards provide a practical foundation for meeting DORA requirements:

• ISO/IEC 27001:2022 supports information security risk management, controls, and supplier security.
• ISO 22301 supports business continuity, response, and recovery.
• ISO/IEC 27035 supports information security incident management.

These standards do not replace DORA’s legal requirements, but they give organizations recognized frameworks to build on.

Common DORA challenges

Even after DORA started to apply, many financial entities are still maturing their programs. Common challenges include:

• Incomplete ICT asset inventories – it is hard to manage risk in systems and dependencies that are not fully mapped.
• The register of information – collecting complete, accurate data on every ICT third-party arrangement, including subcontractors, takes significant effort.
• Incident classification – deciding quickly and consistently whether an incident is major, so reporting deadlines can be met.
• Contract remediation – updating existing contracts with ICT providers to include the provisions DORA requires.
• Skills – DORA brings together risk, security, continuity, legal, and procurement, and few teams have all of that expertise in one place.

Addressing these challenges is less about one-off projects and more about building lasting capabilities, which is why trained professionals are central to DORA programs.

How organizations can prepare

• Confirm scope and proportionality – identify which DORA requirements apply to your type of entity.
• Run a gap analysis of your ICT risk management framework against DORA and its technical standards.
• Strengthen governance – make sure the management body understands and oversees ICT risk.
• Prepare for incident reporting – set up classification criteria and escalation processes that meet the reporting deadlines.
• Map and manage third parties – complete and maintain the register of information and review key contracts.
• Plan resilience testing – establish a risk-based testing program.

Training paths for DORA

Professionals can build DORA expertise through several PECB training paths available at MIC:

DORA Foundation

A good starting point for professionals who need to understand DORA’s scope, pillars, and key concepts.

DORA Lead Manager

This course develops the competence to plan, implement, and manage a digital operational resilience program in line with DORA. It is particularly relevant to ICT risk managers, compliance officers, information security professionals, and consultants working with financial entities.

ISO 22301 Lead Implementer

For professionals who want to build the business continuity capabilities that support operational resilience.

ISO/IEC 27001 Lead Implementer

For professionals who want to establish an information security management system as a foundation for ICT risk management.

Start your DORA learning journey with MIC

DORA has made digital operational resilience a core responsibility across the EU financial sector, and professionals who understand it are in high demand.

My ISO Certification (MIC) provides access to official PECB training, with study materials, the exam, and the certification application fee included.

Ready to strengthen digital operational resilience?

Explore the DORA Lead Manager course and take the next step toward building your expertise in ICT risk and operational resilience.

---