DORA

DORA (Digital Operational Resilience Act) is an EU regulation that requires financial entities to ensure they can withstand, respond to, and recover from ICT-related disruptions and threats.

The Digital Operational Resilience Act (DORA) is an EU regulation that establishes a comprehensive framework for digital operational resilience in the financial sector.

DORA applies to: - Banks and investment firms - Insurance companies - Payment service providers - Crypto-asset service providers - ICT third-party service providers to financial entities

Five pillars of DORA: 1. ICT Risk Management: Governance and risk frameworks 2. ICT Incident Management: Classification, reporting, response 3. Digital Operational Resilience Testing: Including threat-led penetration testing 4. ICT Third-Party Risk: Monitoring and managing provider risks 5. Information Sharing: Threat intelligence sharing arrangements

Key requirements: - Incident reporting within 24 hours - Annual resilience testing - Third-party risk register - Executive accountability for ICT risk

DORA applies from January 2025.

Why It Matters

DORA is now in effect across the EU, imposing strict digital resilience requirements on financial institutions and—critically—their technology providers. US companies providing ICT services to EU financial entities are directly impacted. Non-compliance risks include regulatory sanctions, loss of contracts with EU financial institutions, and reputational damage in a sector where trust is paramount.

Key Points

EU regulation for financial sector digital resilience

Applies from January 2025

Covers ICT risk, incidents, testing, third parties

Requires incident reporting within 24 hours

Includes critical third-party oversight

Applicable Compliance Frameworks

ISO 27001

Related Terms

Business Continuity

Business continuity planning (BCP) is the process of creating systems of prevention and recovery to deal with potential threats to a company, ensuring critical functions can continue during and after a disaster.

Operational Resilience

Operational resilience is an organization's ability to prevent, adapt, respond to, and recover from disruptions while continuing to deliver critical operations.