Decloak is an AI-powered web security intelligence platform that scans a site's HTTP/TLS posture, JavaScript, and third-party scripts to produce a report anyone can read. This guide is part of Decloak's library of practical, source-backed security guidance.
In this guide
Key takeaways
- DORA stands for the Digital Operational Resilience Act, an EU regulation (Regulation (EU) 2022/2554) that sets binding ICT risk-management, incident-reporting, resilience-testing, and third-party-oversight requirements for the financial sector.
- It entered into force on 16 January 2023 and has been directly applicable across all EU member states since 17 January 2025 - it isn't upcoming, it's already in force.
- It applies to roughly 20 categories of financial entities (banks, insurers, investment firms, payment institutions, crypto-asset service providers, and more) and, indirectly, to their "critical" ICT third-party providers.
- Outside finance and compliance circles, "DORA" is also used for unrelated things - a DevOps delivery-metrics framework, a US state licensing agency, a consumer chatbot product - none of which have anything to do with this regulation.
What does DORA actually stand for?
Digital Operational Resilience Act. It's the EU's answer to a gap regulators identified after years of financial-sector cybersecurity rules that focused on capital requirements rather than the actual resilience of the technology underneath them - DORA is specifically about whether a bank, insurer, or investment firm's systems can withstand, respond to, and recover from an ICT disruption, not just whether it's adequately capitalized against one.
Why does it matter, in practical terms?
Because it's enforceable now, not aspirational. A financial entity in scope that hasn't implemented DORA's ICT risk-management framework, incident-classification and reporting process, resilience-testing program, and third-party oversight register is already out of compliance, not "getting ahead of" a future deadline. National competent authorities activated their administrative-penalty powers under DORA on the same date the regulation became applicable - 17 January 2025 - across all 27 EU member states.
Who has to comply?
Financial entities as DORA's Article 2 defines them - a broad list that includes credit institutions, payment and e-money institutions, investment firms, insurance and reinsurance undertakings, crypto-asset service providers, and several other regulated categories - plus, indirectly, any ICT third-party provider a financial entity relies on for a critical function. A subset of the largest third-party providers are designated "critical" and fall under a direct EU-level oversight framework of their own.
Where do I go for the details?
This page exists to settle the "which DORA" question. For the substance - the five pillars, the exact compliance requirements, who specifically has to comply, the real incident-reporting timeline - see the dedicated guides linked elsewhere on this site rather than duplicating them here.
If you're looking for a different DORA
"DORA" isn't unique to this regulation. If the context you actually care about is deployment frequency, lead time for changes, or other software-delivery metrics, you're thinking of DevOps Research and Assessment (DORA), the Google Cloud-affiliated research team behind the annual State of DevOps report - a completely separate thing with no security or compliance meaning. If you landed here looking for a US state's professional-licensing lookup or a consumer chatbot app, that's a different organization or product that happens to share the acronym, and this page - like the rest of this site - has nothing to do with it.
Related guides
ISO 9001:2026 - What’s New, When It Arrives, and How to Prepare
ISO 9001:2026 was published 16 September 2026, adding quality culture, ethics and climate-change clauses while keeping the familiar 10-clause structure. The key changes, the transition timeline, and why ISO/IEC 27001 - not ISO 9001 - is the standard that actually covers information security.
How ServiceNow Helps Financial Institutions Achieve DORA Compliance
ServiceNow's DORM app automates DORA's incident and third-party reporting workflow - but it manages risk data, it doesn't discover it. What ServiceNow actually covers, what DORA's real incident-reporting clock requires, and where a technical security scan fills the gap.
What is a SOC 2 audit and why does it matter for SaaS businesses?
A SOC 2 audit is a CPA - led attestation that evaluates a service organization’s controls against the AICPA Trust Services Criteria, delivering a report that proves data - security practices to customers and partners.