Digital Operational Resilience Act (DORA)

The Digital Operational Resilience Act (DORA), officially Regulation (EU) 2022/2554, is a landmark piece of European Union legislation designed to strengthen the Information and Communication Technology (ICT) security and operational resilience of the financial sector.

DORA is unique because it shifts the focus from simply minimizing risk to proactively ensuring the continuity and recovery of critical ICT systems and services. It applies to a broad range of entities, including banks, insurance companies, investment firms, and their critical third-party ICT service providers.

Talk to dora expert

The Five Pillars of DORA Compliance

DORA implementation services focus on aligning an organization’s framework with the five core pillars mandated by the regulation:

1. ICT Risk Management

Financial entities must implement a comprehensive and well-documented ICT Risk Management Framework.

  • Key Requirements:

    • Develop detailed Business Continuity Plans (BCPs) and Disaster Recovery Plans (DRPs).

    • Establish and regularly review a formal ICT Risk Appetite.

    • Conduct ongoing, systemic risk assessments of all ICT systems and processes.

    • Ensure Board and Senior Management oversight and accountability for the framework.

2. ICT Incident Reporting and Management

DORA mandates a harmonized process for classifying, managing, and reporting ICT-related incidents and cyber threats.

  • Key Requirements:

    • Establish clear detection, management, and escalation processes for ICT incidents. 

    • Comply with strict reporting timelines for major ICT-related incidents to competent national authorities (e.g., initial notification within 4 hours of classification, intermediate report within 72 hours, and a final report within one month).

    • Implement systems for logging, analyzing, and documenting all incidents to feed into continuous improvement.

3. Digital Operational Resilience Testing

Entities must regularly test the effectiveness of their systems and controls.

  • Key Requirements:

    • Conduct an annual testing program including vulnerability assessments, scenario-based tests, and penetration testing.

    • Threat-Led Penetration Testing (TLPT): For financial entities deemed significant, mandatory, full-scope TLPT must be conducted every three years by accredited external testers.

    • Remediation plans for weaknesses found during testing must be documented and implemented swiftly.

4. ICT Third-Party Risk Management (TPRM)

DORA imposes strict rules for managing risks arising from third-party providers (especially cloud services and data centers).

  • Key Requirements:

    • Maintain a detailed, up-to-date Register of Information (RoI) on all ICT third-party arrangements.

    • Ensure contracts with ICT service providers performing critical or important functions include specific mandatory clauses (e.g., audit rights, incident notification, exit strategies).

    • Address and monitor concentration risk to ensure the organization is not over-reliant on a single Critical Third-Party Provider (CTPP).

5. Information Sharing

Entities are encouraged to share cyber threat intelligence and information with each other to enhance collective awareness and defense.

  • Key Requirements:

    • Establish formal arrangements (e.g., in communities or exchanges) to share cyber threat information and intelligence, in compliance with GDPR.