DORA (Digital Operational Resilience Act)

Banks, insurers, investment firms and payment companies run almost entirely on technology. A cyberattack, a failed software release or an outage at a cloud provider can stop payments, freeze trading or expose customer data, and because financial firms share many of the same technology providers, a single failure can spread across the system. Before DORA, EU rules on technology risk were scattered across different laws and guidelines, and national approaches varied. DORA replaces this patchwork with one set of detailed requirements that applies directly across the European Union. It applies to firms of all sizes, although requirements are scaled to each firm's size and risk.

DORA was adopted as Regulation (EU) 2022/2554 and has applied since January 17, 2025. As a regulation rather than a directive, it applies directly in every member state without needing national laws, although detailed technical standards set out much of how it works in practice. It covers around 20 types of financial entities, from credit institutions and insurers to crypto-asset service providers, and brings critical technology providers under direct EU oversight. For risk, technology, compliance and procurement teams in financial services, DORA is the central framework for operational resilience.

Definition of DORA

The Digital Operational Resilience Act is an EU regulation establishing uniform requirements for the security of network and information systems supporting the business processes of financial entities, covering ICT risk management, incident reporting, resilience testing, information sharing and the management of ICT third-party risk.

It is a specific application of operational resilience to financial services, takes precedence over the NIS2 Directive for financial entities and places heavy emphasis on third-party risk management.

The Five Pillars of DORA

ICT risk management requires a documented framework for identifying, protecting against, detecting, responding to and recovering from ICT risks, with the management body ultimately responsible. The framework must be reviewed at least once a year and after major incidents.

ICT-related incident management, classification and reporting requires firms to classify incidents using common criteria and report major incidents to their supervisor, with an initial notification within hours and intermediate and final reports to follow.

Digital operational resilience testing requires a program of tests, from vulnerability scans to scenario tests, and for certain significant firms, threat-led penetration testing at least every three years.

ICT third-party risk management requires firms to manage risks from technology providers, include specific terms in contracts and keep a register of information covering all ICT third-party arrangements.

Information sharing allows firms to exchange cyber threat intelligence within trusted communities. Participation is voluntary, but firms must notify their supervisors when they join such arrangements.

Oversight of Critical Technology Providers

DORA creates a framework for direct EU oversight of ICT providers that are critical to the financial sector, such as major cloud and data providers.

The European Supervisory Authorities assess providers using criteria such as how many financial firms depend on them and how hard they would be to replace. Designation brings obligations for the provider, but financial firms remain fully responsible for managing their own use of it.

The authorities published the first list of designated critical ICT third-party providers in November 2025.

Designated providers are subject to a lead overseer who can request information, carry out inspections and issue recommendations.

Importance of DORA in Risk and Compliance

DORA harmonizes expectations. Financial entities across the EU now follow the same core rules for managing technology risk, which simplifies compliance for groups operating in several countries. It also gives supervisors a common basis for comparing firms.

It strengthens accountability. The management body must define, approve and oversee the ICT risk management framework and is responsible for its effectiveness. Members of the management body must keep their knowledge of ICT risk up to date.

It also addresses concentration risk. Oversight of critical providers and detailed contract requirements reduce the risk that one provider's failure disrupts the financial system.

DORA and Financial Management

Compliance programs often require investment in ICT risk tooling, testing, incident management and contract renegotiation with technology providers.

The register of information requires firms to map which providers support which functions, which also shows where technology spending is concentrated.

Exit strategies for critical providers may require budget for alternative arrangements or data portability.

Mapping DORA requirements to existing controls and frameworks avoids duplicate investment, especially for groups also subject to other resilience rules.

Common Challenges

Building a complete register of information is demanding, since it requires detailed data on contracts, services and supply chains. Data is often spread across procurement, legal, IT and business teams.

Renegotiating contracts with large technology providers to include required terms can be slow, especially for smaller firms with little bargaining power. Many providers have published standard DORA addenda to make this easier.

Classifying incidents quickly enough to meet reporting deadlines requires mature detection and decision processes.