DORA (DORA)
The EU Digital Operational Resilience Act, applying from January 2025, setting ICT risk, incident reporting, testing and third-party rules for financial entities.
Overview
DORA harmonises ICT risk management across EU financial services, requires classification and reporting of major ICT incidents, mandates resilience testing including threat-led penetration testing for some firms, and regulates ICT third-party risk, including direct oversight of critical ICT providers.
As regulation it is binding and specific, and it is the layer most directly mapped to controls. The authorities most closely connected to it are EBA and ESMA.
Check the official sources below for legal scope, applicable dates and exceptions. This entry is an explanatory reference, not legal advice.
Why it matters
It makes operational resilience a hard legal requirement across EU finance.
Who it affects
EU banks, insurers, investment firms, payment and crypto firms, and their critical ICT providers.
Where it sits
Ten linked steps connect where you operate to the proof that you complied.
- 01Jurisdiction
- 02Industry
- 03Activity
- 04Authority
- 05Regulation
- 06Requirement
- 07Guidance
- 08Control
- 09Evidence
- 10Enforcement
Connections
The terms most closely tied to DORA. Select one to open it.
What to do about it
- 1Confirm whether you are in scope: who it covers, which activities and where.
- 2Break it into testable requirements.
- 3Map each requirement to a control and an owner.
- 4Track amendments, implementing rules and guidance.
- 5Keep sealed evidence for every control run.
From requirement to evidence.
DORA obligations are mapped to incident, resilience and vendor controls, with reporting clocks automated.
Request early access →