Skip to content
TECHNOMATON | Docs SAI Certified Trainers

DORA: Overview

Regulation: EU 2022/2554 (Digital Operational Resilience Act) Effective: 17 January 2025 (fully applicable) Scope: Digital operational resilience of the financial sector

What is DORA?

DORA (Digital Operational Resilience Act) is an EU regulation that establishes a uniform framework for managing ICT risks in the financial sector. It is a lex specialis --- for financial institutions it replaces NIS2 requirements in the areas of ICT risk management, incident reporting and resilience testing.

Who falls under DORA?

Financial entities (Art. 2)

CategoryExamples
Credit institutionsBanks, savings banks
Payment institutionsPayment services, e-money
Investment firmsSecurities dealers
Insurance undertakingsLife and non-life insurance
Reinsurance undertakingsReinsurance companies
Pension fundsIORPs
Crypto-assetsCrypto-asset service providers (from MiCA)
ICT third partiesCritical ICT providers to the financial sector

Simplified regime (Art. 16)

Smaller entities may use a simplified ICT risk management framework.

Five pillars of DORA

Relationship to other regulations

DORA vs NIS2

AspectNIS2DORA
TypeDirectiveRegulation
ScopeAll sectorsFinancial sector only
RelationshipGeneral frameworkLex specialis (replaces NIS2 for finance)
Incident reporting24h/72hBy classification + ESAs
TestingPen testsTLPT (Threat-Led) for significant institutions
Third-partySupply chainICT concentration risk + ESAs oversight

DORA + GDPR + AI Act

Timeline

Penalties

ViolationPenalty
Financial entitiesUp to EUR 10M or 1% of global turnover
Critical ICT providersUp to EUR 1M daily (periodic penalty)
Individuals (management)Possibility of individual sanctions

Supervisory authorities:

  • National financial authority --- for domestic financial entities
  • ESAs (EBA, EIOPA, ESMA) --- direct oversight of critical ICT providers

Key requirements

ICT Risk Management Framework (Art. 6)

  • Documented framework approved by the board
  • Digital Operational Resilience Strategy
  • Risk tolerance defined by the board
  • At least annual review

Incident Reporting (Art. 19)

PhaseTimelineContent
Initial notificationWithout undue delayBasic incident information
Intermediate reportOngoingUpdates, impacts
Final reportWithin 1 monthRoot cause, lessons learned

TLPT (Art. 26)

  • For “significant” financial institutions (designated by the regulator)
  • Threat-Led Penetration Testing
  • Every 3 years
  • Certified testers (TIBER-EU framework)

ICT Third-Party Registry (Art. 28)

  • Register of all ICT third parties
  • Identification of critical providers
  • Submission of register to ESAs (deadline 30.4.2025)
  • Ongoing updates

Next steps

  1. Go through the DORA checklist
  2. Check finance-specific guidance
  3. Verify scope with your national regulator

Sources