DORA (Digital Operational Resilience Act)

What it is

The Digital Operational Resilience Act (DORA) is an EU regulation on how financial firms manage information and communication technology (ICT) risk. It applies to banks, investment firms, payment and e-money institutions, insurers, fund managers, crypto-asset service providers, trading venues and others. It has five pillars:

1. ICT risk management: a framework owned by the management body, with asset inventories, protection, detection, response, recovery and backup policies.
2. ICT-related incident management and reporting: classify incidents and report major ones to the competent authority.
3. Digital operational resilience testing: a yearly testing programme and, for larger firms, threat-led penetration testing (TLPT) every three years.
4. ICT third-party risk: contract clauses, a register of information on all ICT arrangements, and exit plans.
5. Information sharing on cyber threats between firms.

DORA also gives the European Supervisory Authorities direct oversight of critical ICT third-party providers, such as large cloud companies. Many details sit in regulatory and implementing technical standards.

Why it matters

Before DORA, ICT rules were spread across sector guidelines and national laws. DORA replaces them with one directly applicable text and a proportionality regime for smaller firms. It makes boards accountable for ICT risk and gives supervisors a common view of incidents and third-party dependencies across the EU.

Worked example

Illustrative numbers.

A payment institution has 120 ICT contracts. Fifteen support critical or important functions, such as card authorisation. Each one needs DORA contract clauses, an exit strategy and a full entry in the register of information.

At 09:00 its card authorisation service fails. At 11:00 the incident meets the major classification criteria (clients affected, duration, critical service). The firm sends an initial notification within 4 hours of classification, so by 15:00, and within 24 hours of becoming aware. An intermediate report follows within 72 hours, and a final report with root cause within one month.

Who uses it

• Operational risk analysts maintain the ICT risk framework, incident taxonomy and reporting process.
• Cyber GRC consultants run gap analyses and design testing programmes.
• IT auditors test controls and review the register of information.
• Regulatory change analysts track the technical standards and update policies.
• Service delivery managers renegotiate supplier contracts and exit plans.

Common confusions

• DORA is a regulation, so it applies directly without national transposition. A separate amending directive adjusted existing sector directives.
• DORA covers all ICT risk, including outages and human error, beyond cybersecurity alone.
• NIS2 is a separate cybersecurity directive. For financial entities DORA acts as the sector-specific law.
• The EBA outsourcing guidelines still apply to non-ICT outsourcing; for ICT services, DORA sets the binding requirements.
• Oversight of critical ICT providers does not move responsibility away from the financial firm, which stays fully accountable.