DORA for Financial Entities: Building Operational Resilience
How the Digital Operational Resilience Act works in practice: ICT risk management, incident reporting, resilience testing and the rules for ICT third-party providers.
Explore the DORA Guide
Eleven chapters, each one readable on its own. Most include a tool you can use as you read.
DORA at a glance: the five pillars
DORA has applied since 17 January 2025. It sets one set of ICT resilience rules for banks, insurers, investment firms and many other financial entities.
Who DORA applies to and the proportionality principle
DORA covers a wide range of financial entities, and the depth of the requirements scales with size and risk profile.
ICT risk management framework
The framework covers identification, protection, detection, response, recovery and learning for all ICT assets.
Classifying and reporting major ICT incidents
Major ICT incidents must be classified with set criteria and reported to the supervisor in an initial, intermediate and final report.
Digital operational resilience testing
Entities need a testing programme that covers vulnerability scans, scenario tests and other checks on critical systems.
Threat-led penetration testing (TLPT)
Larger entities must run advanced threat-led penetration tests at least every three years.
Managing ICT third-party risk
You remain fully responsible for risks that come from ICT providers, and you need a strategy for managing them.
The register of information
All contracts with ICT third-party providers must be recorded in a register of information in a set format.
Contract terms for ICT service providers
Contracts with ICT providers must contain a set of mandatory terms on service levels, security, access and exit.
Information sharing arrangements
Financial entities may share cyber threat information with each other within trusted communities.
Preparing for supervisory review
Supervisors will review the framework, the register, incident handling and testing results.
Check Your DORA Readiness
Work through the five DORA pillars and get the checklist in your inbox.
- Framework: Document an ICT risk management framework. Chapter 3
- Incidents: Classify and report major ICT incidents. Chapter 4
- Testing: Run a resilience testing programme. Chapters 5 to 6
- Third parties: Keep the register of information current. Chapters 7 to 9
Get Your Free DORA Gap Checklist
Delivered to your inbox instantly.
No spam. EU data residency. Unsubscribe any time.
Get a 30-Minute Security Briefing.
No Pitch Deck.
Talk to a Sweden-based analyst. We'll review your posture, map your gaps and give you a clear picture of where you stand, in plain language.
Book a Free Briefing