Understanding the Digital Operational Resilience Act (DORA)

The Digital Operational Resilience Act is a European Union (EU) regulation that targets how financial institutions and their information and communication technology (ICT) partners manage cyber risk. It creates a binding oversight framework and establishes technical standards that EU financial entities and their service providers must implement in their ICT systems.

The European Commission proposed DORA in September 2020. Regulation (EU) 2022/2554 was adopted in December 2022, entered into force on January 16, 2023, and became applicable on January 17, 2025. The European Supervisory Authorities subsequently developed regulatory and implementing technical standards that provide additional detail on areas such as ICT risk management, incident classification and reporting, registers of information, third-party arrangements, resilience testing, and oversight.

Each EU Member State is responsible for enforcing compliance. A designated regulator, or “competent authority,” can request entities to take specific security measures and remediate known vulnerabilities.

The European Supervisory Authorities designate critical ICT third-party providers and assign a Lead Overseer. Under the DORA oversight framework, a Lead Overseer may request information, conduct investigations and inspections, issue recommendations, and impose periodic penalty payments in circumstances specified by the regulation. Enforcement measures applicable to financial entities are administered through the relevant competent authorities and national frameworks.

DORA applies directly to the financial institutions operating in the EU financial sector, including banks, credit institutions, investment firms, and insurance companies.

It also significantly affects ICT third-party service providers because financial entities must assess provider risk, maintain information about ICT contracts, and include specified provisions in relevant agreements. ICT providers designated as critical by the European Supervisory Authorities are additionally subject to direct EU oversight. In other words, any technology company that delivers ICT systems to the EU financial sector must adhere to its regulations. Under DORA, that includes any ICT provider based outside the EU but still operating within its jurisdiction.

A third-country ICT provider is not required to establish an EU subsidiary merely because it supplies services to an EU financial entity. The establishment requirement is connected to the critical-provider oversight regime and should therefore be described only in that context.

DORA applies across the EU financial sector and to the ICT providers that serve it. As a directly applicable EU regulation, it establishes a wide set of operational requirements.

We’ll cover these in more detail later, but at a high level:

• Covered entities must establish a comprehensive digital operational resilience strategy that incorporates cybersecurity risk assessments, business continuity plans, and incident response protocols.
• Entities are required to promptly report major ICT-related incidents affecting their digital operations to the relevant competent authority, ensuring a coordinated response across the EU.
• Financial institutions must manage and monitor the risks associated with their third-party ICT providers. This includes conducting due diligence and ensuring vendors meet contractual requirements.
• Organizations must test the operational resilience framework regularly to identify and address weaknesses.
• Entities must have governance structures with senior management and boards responsible for overseeing resilience and ensuring compliance.
• DORA encourages organizations to share threat intelligence and best practices, collectively enhancing operational risk management.

Financial service providers are at risk. DORA aims to bolster digital operational resilience in two ways:

1. Addressing ICT risk management for financial institutions at scale
2. Harmonizing risk management regulations into one cohesive framework

Previously, EU regulations primarily focused on ensuring financial firms had enough capital to cover operational risks and disruptions. Some regulators released guidelines on ICT risk management, but they didn’t apply equally to all entities. Plus, they were based on general best practices – not technical standards.

Without a unified oversight framework, each EU Member State issued its own requirements. This created a maze of disjointed regulations that cross-border enterprises couldn’t easily navigate.

DORA solves this problem with a single, harmonized set of rules that applies to all covered entities regardless of where they operate in the EU.

By harmonizing risk management in the financial sector, DORA minimizes confusion and raises the bar for ICT security, operational risk management, and business continuity.

DORA defines digital operational resilience as a financial entity's ability to build, assure, and review its operational integrity and reliability – ensuring it can continue to deliver services throughout ICT disruptions such as cyberattacks and outages.

Continuity is especially vital in the financial sector, where ICT systems play a key role in how consumers access and manage their funds. According to ESMA, financial services have become heavily reliant on digital technologies to conduct day-to-day operations. That dependency, in turn, has increased cyber risk greatly.

Indeed, even a single ICT incident can have major ripple effects on critical infrastructure. When not managed properly, risks can disrupt financial service delivery, which can impact other entities, sectors, and even the European economy altogether.

Imagine a scenario in which an investment bank’s third-party trading platform goes offline during a denial-of-service attack. Not only would this disrupt the end-user experience, but it could also cost clients a lot of money on the market.

To complicate matters, geopolitical events have given rise to state-sponsored attackers and rogue hacktivists targeting financial services. Russia’s war in Ukraine, for instance, inspired pro-Russian cybercriminals to attack the European Investment Bank’s network infrastructure in 2023. Fortunately, the incident only briefly impacted the availability of the bank’s website.

DORA’s comprehensive framework is structured around five pillars. Each addresses a different aspect of digital operational resilience and risk management, but in combination, they form the foundation for a strong and secure financial sector.

1. ICT risk management and governance

Per Articles 5-6, management bodies are responsible for defining, approving, overseeing, and remaining accountable for the financial entity’s ICT risk management arrangements.

Broadly, organizations are required to have systems in place to maintain business continuity in the event of an ICT incident. Risk management frameworks should include strategies, policies, procedures, and tools to protect physical components and digital infrastructure from unauthorized access or damage.

Additionally, financial entities within scope are required to:

• Map their ICT systems to identify critical assets, functions, and dependencies between providers
• Conduct regular risk assessments on their ICT systems to document, classify, and plan for cyber threats
• Complete business impact analyses to understand how severe disruptions might affect operations
• Implement suitable cybersecurity measures, such as identity and access management (IAM) tools, automated threat detection systems, and so on
• Establish business continuity and disaster recovery plans for cyberattacks, service failures, and natural disasters
• Complete post-incident reviews to learn from past events and drive continuous improvement

2. Incident reporting

According to Article 17, financial entities must classify ICT-related incidents using the applicable DORA criteria and report major incidents to the relevant competent authority using an initial notification, an intermediate report, and a final report. The detailed content and time limits are specified in Commission Delegated Regulation (EU) 2025/301. financial entities must classify ICT-related incidents using the applicable DORA criteria and report major incidents to the relevant competent authority using an initial notification, an intermediate report, and a final report. The detailed content and time limits are specified in Commission Delegated Regulation (EU) 2025/301.

And, according to Articles 18-19, organizations must:

• Classify ICT-related incidents with the criteria that apply to different impact levels
• Create a common template or procedure for reporting incidents to the supervisory authority
• Inform end-users and customers about a major incident without delay, primarily if an incident affects clients’ financial interests, and all measures being used to mitigate its consequences

Notably, DORA requires entities to file three different types of reports:

1. An initial report to notify the authorities
2. An intermediate report to communicate progress toward resolving the incident
3. A final report analyzing the incident’s root causes and how they were resolved

3. Digital operational resilience testing

DORA establishes a few baseline requirements related to resilience testing. Financial entities must maintain a proportionate, risk-based digital operational resilience testing program. ICT systems and applications supporting critical or important functions must be tested appropriately and at least annually.

Per Articles 25-26, entities must:

• Establish a testing program that matches their size, business, and risk profiles
• Include a range of assessments, tests, methodologies, and tools
• Follow a risk-based approach, taking into account the evolving landscape of ICT risks
• Ensure tests are undertaken by independent parties
• Prioritize, classify, and fully remedy all discovered issues and vulnerabilities
• Test all critical ICT systems and applications at least annually

Additionally, Article 26 states financial entities identified by competent authorities must also conduct advanced threat-led penetration testing at least every three years, unless the competent authority adjusts that frequency.

4. Third-party risk management

DORA expects financial firms to actively manage their third-party risk landscape and keep operational resilience in mind when negotiating contractual arrangements. Specifically, DORA establishes the following rules regarding third-party risk management:

• Financial entities must keep a register of information relating to contractual agreements with third-party ICT service providers.
• Firms must report to competent authorities at least once per year on new arrangements involving ICT services, including the categories of provider and contractual arrangement, as required by the applicable reporting framework.
• Entities should practice due diligence when evaluating contracts by identifying all relevant risks and potential conflicts of interest. They must also negotiate stipulations involving exit strategies, audits, and performance targets for accessibility and security.
• The rights and obligations of the financial entity and the ICT third-party service provider should be allocated and set out in writing, accessible to both parties.
• ICT third-party service providers designated as critical by the ESAs are subject to direct oversight from a relevant supervisory authority.
• Regulatory Technical Standards (RTS) for subcontracting-chain risks were entered into application on July 22, 2025, and cover precontractual risk assessment, due diligence, implementation, monitoring, and management of subcontracted ICT services supporting critical or important functions.

According to the regulation, entities are discouraged from contracting with ICT companies that fail to meet the appropriate technical standards. Competent authorities may even suspend or terminate agreements that don’t comply.

5. Information sharing

DORA also encourages collaboration among trusted financial entities through voluntary cyber-threat information-sharing arrangements to:

• Raise awareness of ICT-related risks
• Minimize the spread of ICT threat vectors
• Share defensive techniques, mitigation strategies, and threat intelligence

DORA is the sector-specific EU framework for digital operational resilience in financial services, while NIS2 establishes broader cybersecurity obligations across multiple critical sectors. Article 4 of the NIS2 Directive confirms that DORA's provisions apply instead of NIS2 for overlapping requirements – ICT risk management, major-incident reporting, resilience testing, and ICT third-party risk. Organizations should still assess whether other NIS2 provisions or national implementing laws apply to their activities.

According to Article 4 of the NIS2 Directive, DORA’s provisions shall apply instead of those outlined in NIS2. That means DORA takes precedence for financial entities, at least when it comes to ICT risk management, incident reporting, and resilience testing.

Preparing for DORA Compliance

DORA sets a high bar for risk management, which requires coordinated governance, operational, technical, and third-party risk-management capabilities. Fortunately, there’s a clear path you can take to get started:

1. Conduct a gap analysis: An initial gap analysis involves assessing the entire company profile from top to bottom, defining its state of cyber maturity and understanding its existing risk management framework. This exercise will help you determine the extent to which your current processes and procedures should be updated.
2. Mandate ICT training: It’s best to create an ongoing training program for all employees – management included. Leaders are liable for DORA noncompliance, so ensure everyone stays informed and vigilant of the latest ICT security threats.
3. Audit third-party contracts: Taking a deep dive into your contractual arrangements can help you understand dependencies with ICT providers. In turn, you can identify and prioritize security measures for protecting these connections. Inventory all contracts, including cloud service providers, software vendors, and other ICT systems. Then, ensure they have provisions that align with DORA requirements.
4. Demonstrate your controls and security measures; don’t just document them. Regulators are looking for organizations to demonstrate that their security measures are working effectively. Documenting your security measures might have been enough to comply before DORA became applicable. Now, organizations must show that the measures documented were implemented and continue to operate effectively.
5. Implement stronger identity controls internally and with third-party providers.

Strengthen cyber resilience with Entrust

Don’t leave DORA compliance to chance. Whether you’re a financial entity or an ICT provider, Entrust solutions can help you protect critical infrastructure and support your DORA compliance program.

Our solutions include:

• Entrust Cryptographic Security Platform: Unifies management, oversight, and compliance of your cryptographic assets across their lifecycle, bringing together HSMs, PKI, and lifecycle management for keys, certificates, and secrets. CSP Compliance Manager delivers the inventory, risk scoring, and immutable audit trail that support the ICT asset identification and documentation requirements of Article 8.
• Hardware security modules (HSMs): Provide a FIPS 140-3 Level 3 certified environment for generating, managing, and protecting cryptographic keys – supporting the key protection measures required under Article 9(4)(d).
• Identity and access management: Entrust Identity as a Service is an intelligent platform that streamlines user authentication, authorization, and access control. Connect with your consumers through secure portals, identity proofing, and more.
• Public key infrastructure (PKI): Entrust PKI helps provide a framework for secure communications and authentication, using digital certificates to verify entities and encrypt data.