DORA for Financial Entities: Building Operational Resilience
How the Digital Operational Resilience Act works in practice: ICT risk management, incident reporting, resilience testing and the rules for ICT third-party providers.
Utforska DORA-guiden
Elva kapitel, vart och ett läsbart för sig. De flesta innehåller ett verktyg du kan använda medan du läser.
DORA at a glance: the five pillars
DORA has applied since 17 January 2025. It sets one set of ICT resilience rules for banks, insurers, investment firms and many other financial entities.
Who DORA applies to and the proportionality principle
DORA covers a wide range of financial entities, and the depth of the requirements scales with size and risk profile.
ICT risk management framework
The framework covers identification, protection, detection, response, recovery and learning for all ICT assets.
Classifying and reporting major ICT incidents
Major ICT incidents must be classified with set criteria and reported to the supervisor in an initial, intermediate and final report.
Digital operational resilience testing
Entities need a testing programme that covers vulnerability scans, scenario tests and other checks on critical systems.
Threat-led penetration testing (TLPT)
Larger entities must run advanced threat-led penetration tests at least every three years.
Managing ICT third-party risk
You remain fully responsible for risks that come from ICT providers, and you need a strategy for managing them.
The register of information
All contracts with ICT third-party providers must be recorded in a register of information in a set format.
Contract terms for ICT service providers
Contracts with ICT providers must contain a set of mandatory terms on service levels, security, access and exit.
Information sharing arrangements
Financial entities may share cyber threat information with each other within trusted communities.
Preparing for supervisory review
Supervisors will review the framework, the register, incident handling and testing results.
Check Your DORA Readiness
Work through the five DORA pillars and get the checklist in your inbox.
- Framework: Document an ICT risk management framework. Kapitel 3
- Incidents: Classify and report major ICT incidents. Kapitel 4
- Testing: Run a resilience testing programme. Kapitel 5 till 6
- Third parties: Keep the register of information current. Kapitel 7 till 9
Få din kostnadsfria DORA-checklista
Levereras direkt till din inkorg.
Ingen skräppost. Datalagring inom EU. Avsluta när du vill.
Boka en säkerhetsgenomgång på 30 minuter.
Ingen säljpresentation.
Prata med en Sverigebaserad analytiker. Vi går igenom din säkerhetsnivå, kartlägger dina luckor och ger dig en tydlig bild av läget, på vanlig svenska.
Boka en kostnadsfri genomgång