Digital Operational Resilience Act (DORA)
DORA sets uniform requirements for how financial entities in the EU manage information and communication technology (ICT) risk, treating the ability to withstand, respond to, and recover from ICT disruption as a supervisory obligation on the same footing as capital and liquidity requirements.
Who Needs It
DORA covers roughly twenty categories of financial entities, including:
- Credit institutions (banks), payment institutions, and electronic money institutions
- Investment firms, trading venues, central counterparties, and central securities depositories
- Insurance and reinsurance undertakings and intermediaries
- Managers of alternative investment funds and UCITS management companies
- Institutions for occupational retirement provision (pension funds)
- Credit rating agencies, crowdfunding service providers, and crypto-asset service providers
It also reaches beyond the financial sector itself. ICT service providers that the ESAs designate as critical to the EU financial system (large cloud providers, for example) fall under a direct EU oversight regime run by a Lead Overseer, even though they are not financial entities.
Obligations scale with size and risk. Micro-enterprises (fewer than 10 employees and annual turnover or balance sheet under EUR 2 million) get proportionate treatment, and entities listed in Article 16(1) may operate a simplified ICT risk management framework that keeps the core requirements while reducing administrative burden. Proportionality changes the depth of the work, not whether it applies.
The Five Pillars
DORA's requirements are organized into five areas.
| Pillar | Chapter | Core Requirements |
|---|---|---|
| ICT risk management | II | Governance framework with management-body accountability; documented policies and tools covering identification, protection, detection, response, and recovery; at least annual review |
| Incident management and reporting | III | Classify ICT-related incidents against defined criteria; report major incidents to the competent authority via initial, intermediate, and final reports on standardized templates |
| Resilience testing | IV | Risk-based testing program; annual testing of critical ICT systems and applications by independent parties; remediation tracking for findings |
| Third-party risk management | V | Due diligence before contracting; mandatory contract provisions; a maintained register of information covering all ICT service contracts; concentration risk assessment; documented exit strategies |
| Information sharing | VI | Voluntary arrangements for exchanging cyber threat intelligence with other financial entities |
Two points deserve emphasis. First, the management body carries explicit, personal responsibility for the ICT risk management framework; DORA does not allow resilience to be delegated entirely to the chief information security officer (CISO) function. Second, threat-led penetration testing (TLPT), aligned with the Threat Intelligence-based Ethical Red Teaming (TIBER-EU) framework, is required at least every three years, but only for entities their authorities designate as significant; smaller firms satisfy the testing pillar through the standard annual program.
Enforcement and Key Dates
DORA was adopted on December 14, 2022, entered into force on January 16, 2023, and has applied in full since January 17, 2025. The ESAs flesh out the regulation through binding regulatory and implementing technical standards covering incident classification, reporting templates, the register of information, and TLPT.
Enforcement against financial entities sits with national competent authorities, and remedies and administrative penalties are defined in member state law. For critical ICT third-party providers, the Lead Overseer can impose periodic penalty payments of up to 1% of average daily worldwide turnover for noncompliance. Supervisors can also direct financial entities to suspend or exit contracts with providers that fail oversight.