DORA (Digital Operational Resilience Act)
DORA — Regulation (EU) 2022/2554 — is the EU law on digital operational resilience for the financial sector. It has applied since 17 January 2025 and imposes binding requirements on ICT risk management, incident reporting, resilience testing, and third-party technology oversight.
Who and what it covers
DORA applies to banks, insurers, investment firms, payment institutions, and — importantly for Web3 — crypto-asset service providers (CASPs) licensed under MiCA. Its pillars cover: an ICT risk-management framework; classification and reporting of major incidents (initial, intermediate, and final reports on tight deadlines); annual resilience testing, with threat-led penetration testing (TLPT) every three years for significant entities; and a register of information covering all ICT third-party contracts.
The most consequential piece for vendors is the third-party pillar. Financial entities must contractually secure audit and access rights over their ICT providers, and the ESAs directly oversee designated critical third-party providers (CTPPs) — a first in EU law. Contracts without the mandatory DORA clauses must be remediated.
How it relates to other frameworks
DORA is lex specialis for the financial sector — where it overlaps NIS2, DORA wins. Its risk-management and incident-handling requirements align closely with ISO/IEC 27001 practices, so a certified ISMS covers much of the groundwork, but DORA adds hard obligations the standard does not: statutory reporting deadlines, TLPT, and the register of information.
Frequently Asked Questions
Who does DORA apply to?
Almost the entire EU financial sector — banks, payment and e-money institutions, investment firms, insurers, fund managers, and crypto-asset service providers under MiCA — plus the ICT vendors that serve them, through mandatory contractual clauses and direct oversight of critical third-party providers.
Does DORA replace ISO 27001?
No. DORA is a legal obligation; ISO 27001 is a voluntary certification that gives you the management system to meet it efficiently. A certified ISMS covers much of the ICT risk-management groundwork, but DORA adds statutory duties — incident reporting deadlines, TLPT, and the register of information — that no standard provides.
When did DORA take effect?
It entered into force in January 2023 and has applied in full since 17 January 2025. There is no remaining transition period — requirements are live now.
Related Standards
- •Regulation (EU) 2022/2554 (DORA)
- •ESA RTS/ITS on ICT risk, incident classification, TLPT, and the register of information
- •TIBER-EU — threat-intelligence-based red teaming framework
Free Tools & Resources
Products & Services
Need help with this?
We consult and build across all of these domains — tell us what you are working on.