DORA has applied since 17 January 2025. It sets one set of ICT resilience rules for banks, insurers, investment firms and many other financial entities.
The regulation is built on five pillars: ICT risk management, incident reporting, resilience testing, third-party risk and information sharing.
Key points
- ICT risk management is the foundation for the other pillars
- Incident reporting follows fixed templates and timelines
- Third-party rules reach your critical ICT providers
How this guide is organised
The guide has 11 chapters. Each one stands on its own, so you can read them in order or go straight to the topic you need.
- Who DORA applies to and the proportionality principle
- ICT risk management framework
- Classifying and reporting major ICT incidents
- Digital operational resilience testing
- Threat-led penetration testing (TLPT)
- Managing ICT third-party risk
- The register of information
- Contract terms for ICT service providers
- Information sharing arrangements
- Preparing for supervisory review
Who this guide is for
It is written for IT and security leads, risk and compliance owners and the managers who sign off on the work. This guide takes each pillar in turn and ends with how to prepare for a supervisory review.