Decloak is an AI-powered web security intelligence platform that scans a site's HTTP/TLS posture, JavaScript, and third-party scripts to produce a report anyone can read. This guide is part of Decloak's library of practical, source-backed security guidance.
In this guide
Key takeaways
- Digital Operational Resilience Act is an EU regulation that secures financial - sector ICT systems.
- DevOps Research and Assessment created the DORA metrics that benchmark software - delivery performance.
- San Francisco Declaration on Research Assessment pushes a fairer way to evaluate scholarly output.
- Identify the context you need, then apply the appropriate definition.
What is the Digital Operational Resilience Act (DORA)?
The Digital Operational Resilience Act is an EU regulation that sets a common framework for ICT risk management in the financial sector. It entered into force on 16 January 2023 and will be fully applicable from 17 January 2025. The act requires banks, insurers, investment firms and market infrastructures to design, test and maintain resilient digital services, so they can withstand, respond to and recover from severe digital disruptions.
How to comply with the EU DORA
- Map all critical ICT assets - create an inventory of systems, third - party providers and data flows.
- Implement a risk management process - assess threat likelihood, impact and mitigation controls quarterly.
- Run regular resilience tests - conduct penetration testing, tabletop exercises and disaster - recovery drills at least annually.
- Document and report - maintain a resilience plan and submit required reports to national supervisory authorities.
What is DevOps Research and Assessment (DORA)?
DevOps Research and Assessment is the research team now part of Google Cloud that introduced the DORA metrics used to measure software - delivery performance. The four original metrics are lead time for changes, deployment frequency, change - failure rate and time - to - restore service. In 2024 a fifth metric, deployment - rework rate, was added.
How to use DORA metrics in your team
| Metric | How to calculate | Good practice |
|---|---|---|
| Lead time for changes | Time from code commit to production deployment | Aim for under 1 day for high - performers |
| Deployment frequency | Number of successful deployments per time period | Multiple deployments per day is typical for elite teams |
| Change - failure rate | Percentage of deployments causing a failure in production | Keep below 15 % |
| Time - to - restore service | Mean time to recover from a failure | Target under 1 hour |
| Deployment - rework rate | Percentage of deployments requiring rework after release | Stay under 10 % |
Use continuous integration pipelines to collect these numbers automatically, then compare against the benchmarks published in the State of DevOps report.
What is the San Francisco Declaration on Research Assessment (DORA)?
The San Francisco Declaration on Research Assessment is a global initiative launched in 2012 that calls for better ways to evaluate research outputs. It discourages reliance on journal - impact - factor metrics and promotes assessment based on the content and impact of individual works.
Steps to adopt the research - assessment DORA in your institution
- Revise promotion guidelines - replace impact - factor requirements with criteria that value open data, reproducibility and societal relevance.
- Train evaluators - provide workshops on narrative CVs, altmetrics and peer - review quality.
- Track compliance - audit promotion cases annually to ensure DORA - aligned criteria are applied.
Which DORA definition applies to me?
- If you work in a European financial institution, the EU Digital Operational Resilience Act is the relevant DORA.
- If you lead a software delivery team, the DevOps Research and Assessment metrics are the DORA you need.
- If you are an academic administrator or researcher, the San Francisco Declaration on Research Assessment is the DORA that matters.
How to avoid confusion when searching for DORA
- Add context keywords - use "EU DORA regulation", "DORA metrics" or "DORA research declaration" in your queries.
- Check the source - official EU documents, Google Cloud/DevOps blogs, or the sfdora.org website indicate which DORA is being discussed.
- Verify dates - the EU regulation references 2023 - 2025, the research declaration cites 2012, and the DevOps metrics are tied to annual State of DevOps reports.
Further reading
- EU Digital Operational Resilience Act details: https://www.esma.europa.eu/esmas-activities/digital-finance-and-innovation/digital-operational-resilience-act-dora
- DORA metrics overview (Wikipedia): https://en.wikipedia.org/wiki/DevOps_Research_and_Assessment
- San Francisco Declaration on Research Assessment: https://sfdora.org/about-dora/
Related guides
What is NIST in cybersecurity and why should you care?
NIST is the U.S. agency that creates the Cybersecurity Framework and a suite of standards like SP 800 - 53 that guide risk management for both government and private organizations.
Which NIST Cybersecurity Standards Should My Organization Adopt in 2024 - 2025?
Learn the core NIST publications that form a practical, layered security program, how they map together, and concrete steps to start using them today.
Does the EU AI Act apply to U.S. companies?
Yes - the EU AI Act has extraterritorial reach and can bind U.S. AI providers, deployers, importers or distributors whenever their systems are placed on the EU market, used by an EU entity, or produce output that is used in the Union.