Operational resilience
DORA — Regulation (EU) 2022/2554 on digital operational resilience
The EU regulation requiring the financial sector to manage its ICT risks and its ICT service providers.
At a glance
- Type
- EU regulation, directly applicable
- Applicable since
- 17 January 2025
- Authorities in France
- ACPR and AMF, depending on status
- ICT providers
- In scope by contract (Art. 30) or when designated critical
150 requirements tracked · 149 shared controls
What is DORA?
Regulation (EU) 2022/2554, known as DORA, has applied since 17 January 2025 without transposition. It harmonises the digital operational resilience requirements of financial entities: banks, payment and e-money institutions, investment firms, management companies, insurers and reinsurers, crypto-asset service providers, market infrastructures…
DORA rests on five pillars: ICT risk management, incident management and reporting, resilience testing, ICT third-party risk management and threat information sharing. Technical standards (RTS and ITS) set out the details, and a simplified framework exists for some small entities.
Key requirements
- 1
ICT risk management framework (Art. 5–16)
Management body accountability, resilience strategy, identification, protection, detection, response, recovery, backups and communication.
- 2
ICT-related incidents (Art. 17–23)
Management process, classification against harmonised criteria and reporting of major incidents: initial notification, intermediate report and final report.
- 3
Resilience testing (Art. 24–27)
A proportionate testing programme; threat-led penetration testing (TLPT) for designated entities.
- 4
ICT third-party service providers (Art. 28–30)
Policy, register of information on all ICT arrangements, pre-contract assessment, mandatory contractual clauses and exit strategies.
- 5
Information sharing (Art. 45)
Governed participation in cyber threat information-sharing arrangements.
Summary written by OK-GRC. The texts of ISO standards are protected by copyright and are not reproduced.
How OK-GRC helps
- DORA requirements and their technical standards linked to 149 common controls
- ICT supplier register, criticality, critical or important functions and register of information export
- Incident register with classification and reporting deadlines
- “ICT risk management framework” template, continuity and backup policies
- ICT risks, treatment plans and test tracking in a single tool
- Your ISO 27001 controls already give a starting score of about 48 to 68%
Related frameworks
With ISO 27001 controls in place, your DORA starting score is about 48 to 68%.
The controls you put in place for DORA also count for:
Frequently asked questions about DORA
Is a software vendor in scope of DORA?
Not directly, unless the European authorities designate it as a critical third-party provider. But its financial customers must impose the Article 30 provisions by contract (service levels, audit, incident notification, exit). Preparing with the DORA framework is therefore a commercial advantage.
What is the register of information?
It is the inventory, kept by each financial entity, of all its contractual arrangements with ICT service providers, in a format set by an implementing technical standard. It is sent to the authorities on request.
Informational content up to date as of October 2026; it does not constitute legal advice. Always check the official texts in force.
Ready to simplify your compliance?
Create your workspace in minutes. The assistant suggests the frameworks and priorities that fit your company.
14-day trial with every Pro feature · Nothing charged before the trial ends · No commitment