DORA,explained

What DORA is

DORA (Regulation EU 2022/2554) is an EU regulation, enforced by competent authorities, not a voluntary standard or a certification. It exists because the financial sector depends heavily on technology and third-party providers, and the EU wanted a single, consistent resilience regime across member states.

Who it applies to

DORA applies to a broad range of EU financial entities, such as banks, insurers, investment firms, and payment institutions, and to the critical ICT third-party providers that serve them. If you sell ICT or SaaS into EU finance, your customers will expect you to support their DORA obligations, which flows the requirements down to you.

The five pillars

• ICT risk management: a governed framework owned by the management body, with protection, detection, response, and recovery.
• ICT incident management and reporting: classify incidents and report major ones to the authority within set timelines.
• Digital operational resilience testing: a risk-based testing programme, including threat-led penetration testing for significant entities.
• ICT third-party risk: a register of ICT arrangements, contractual requirements, and oversight of critical providers.
• Information sharing: optional participation in trusted arrangements to share cyber threat intelligence.

The third-party register

One of the most concrete DORA obligations is maintaining a register of information about your ICT third-party arrangements, including which support critical functions, and ensuring contracts contain the required resilience, audit, and exit terms. This is often where financial entities and their vendors put the most work.

How it relates to security frameworks

Much of DORA overlaps an information-security programme: risk management, incident handling, testing, and third-party risk all have direct analogues in ISO 27001 and SOC 2. So if you already run one of those, a large part of the control work carries across, and DORA mainly adds the financial-sector specifics and the reporting obligations.