The EU Digital Operational Resilience Act (DORA) — Regulation (EU) 2022/2554 — is the European Union’s binding framework requiring financial entities to prove they can withstand, respond to, and recover from ICT disruptions. In force since January 2023 and applying from January 17, 2025, DORA moves operational resilience from guidance to law for the EU financial sector.
If you run business continuity for a bank, insurer, investment firm, or anyone selling critical technology to them, DORA is now the shape of your program — whether you call it that or not.
Who DORA Applies To
DORA covers financial entities operating in the EU: credit institutions, payment institutions, insurers and reinsurers, investment firms, crypto-asset service providers, crowdfunding platforms, and more — roughly twenty entity types in total.
It also reaches beyond finance. Critical ICT third-party providers — the cloud platforms, data providers, and software vendors the sector depends on — fall under a dedicated EU oversight framework with direct examination powers. If you’re a technology vendor selling into EU finance, your customers’ DORA obligations are now your commercial reality: expect due-diligence questionnaires, audit rights, and resilience testing demands in every contract renewal.
The Five Pillars
1. ICT risk management. A documented, board-approved framework covering identification, protection, detection, response, and recovery for all ICT risk — mapped to business functions, not just IT assets. The board owns it; “the IT department handles it” is not a compliant answer.
2. Incident classification and reporting. Major ICT-related incidents must be classified against defined criteria and reported to competent authorities within strict timelines — initial notification within 4 hours of classification, intermediate report within 72 hours, final root-cause report within one month. Your incident process needs a clock, not just a playbook.
3. Digital operational resilience testing. A risk-proportionate testing program: vulnerability scans, network security assessments, scenario-based testing — and for the most significant entities, threat-led penetration testing (TLPT) every three years, run against live production systems with recognized threat-intelligence providers.
4. ICT third-party risk management. The part most continuity programs underestimate. Pre-contract risk assessments, concentration-risk analysis, mandatory contractual clauses (audit rights, security measures, termination rights), and ongoing monitoring of every ICT provider supporting critical functions. Sub-outsourcing chains must be mapped — your provider’s providers are in scope.
5. Voluntary information sharing. Cyber-threat information and intelligence may be shared between financial entities through trusted arrangements, with data-protection safeguards. Sharing is encouraged, not mandated — but regulators watch who participates.
Why Continuity Managers Should Care
DORA is a continuity regulation wearing a cybersecurity uniform. Look past the ICT language and the requirements are familiar: business impact analysis mapped to technology dependencies, incident response with defined timelines, resilience testing with board visibility, and third-party risk management with teeth.
Three things change in practice:
Timelines get legal force. The 4-hour / 72-hour / one-month incident reporting cascade means your detection-to-classification process must run in hours, not days. Tabletop it — most organizations discover their classification step is the bottleneck.
Testing gets adversarial. TLPT for significant entities means real attackers (simulated) against production. Your continuity plans for “what if core banking is down for a day” stop being hypothetical.
Concentration risk gets named. If three critical functions depend on one cloud region, DORA expects an exit strategy — documented, tested, and credible. “The vendor is too big to fail” is not a strategy.
DORA Compliance Checklist
1. Map ICT dependencies to business functions. Every critical business function gets its supporting systems, providers, and sub-providers documented. No map, no program.
2. Stand up the incident classification clock. Define who classifies, against what criteria, and how the 4-hour notification gets out. Then exercise it.
3. Build the testing calendar. Annual program minimum; TLPT on a three-year cycle for significant entities. Test results go to the board.
4. Renegotiate ICT contracts. Audit rights, security and resilience clauses, termination assistance, sub-outsourcing transparency. Start with critical providers — the backlog is real.
5. Document the exit strategies. For each concentrated ICT dependency: the alternative, the migration plan, and the last time you tested it.
6. Align the BIA. Your business impact analysis and DORA’s ICT risk management framework should be one coherent picture, not two documents that disagree.
Frequently asked questions
What is the EU Digital Operational Resilience Act (DORA)?
DORA (Regulation (EU) 2022/2554) is the EU’s binding framework requiring financial entities to withstand, respond to, and recover from ICT disruptions. In force since January 2023 and applying from January 17, 2025, it covers ICT risk management, incident reporting, resilience testing, third-party risk, and threat-information sharing.
Who does DORA apply to?
Around twenty types of EU financial entities — banks, insurers, investment firms, payment institutions, crypto-asset service providers, and others — plus critical ICT third-party providers under a dedicated EU oversight framework.
What are DORA’s incident reporting timelines?
Major ICT-related incidents follow a fixed cascade: initial notification within 4 hours of classification, an intermediate report within 72 hours, and a final root-cause report within one month.
What is threat-led penetration testing (TLPT) under DORA?
TLPT is DORA’s most demanding test: simulated real-world attacks against live production systems, using recognized threat intelligence, required every three years for the most significant financial entities.
How does DORA affect business continuity programs?
DORA gives legal force to continuity disciplines: incident response must run on a 4-hour classification clock, resilience testing becomes adversarial, and ICT concentration risk requires documented, tested exit strategies.
Related Reading
- Financial Services Continuity: OCC, FFIEC, SEC & Basel Requirements
- Supply Chain Resilience: The Complete Professional Guide
- Risk Assessment & Threat Analysis for Continuity Planning