Decloak is an AI-powered web security intelligence platform that scans a site's HTTP/TLS posture, JavaScript, and third-party scripts to produce a report anyone can read. This guide is part of Decloak's library of practical, source-backed security guidance.
In this guide
- Key takeaways
- What is DORA in the EU?
- Which organisations must follow DORA?
- What are the main compliance pillars of DORA?
- How can developers start preparing for DORA?
- What are the penalties for non - compliance?
- How does DORA relate to other EU regulations?
- Where can I find the official text?
- Final checklist for developers
Key takeaways
- DORA = Digital Operational Resilience Act, EU Regulation (EU) 2022/2554.
- It applies to all financial institutions operating in the EU, including banks, insurers, and crypto service providers.
- Core requirements cover ICT risk management, incident reporting, digital testing, and third - party oversight.
- Non - compliance can lead to fines up to 2 % of annual turnover or €10 million (whichever is higher), plus reputational damage.
- Developers can start compliance by mapping assets, implementing continuous monitoring, and using automated reporting tools.
What is DORA in the EU?
DORA stands for the Digital Operational Resilience Act, an EU regulation that creates a binding framework for ICT risk management and operational resilience of financial entities. It entered into force in January 2023 and has been fully applicable across the EU since 17 January 2025.
Which organisations must follow DORA?
Any firm that provides financial services in the EU - banks, payment institutions, insurance companies, crypto - asset service providers, and market infrastructures - must comply. The rule also reaches third - party ICT providers that serve those firms, such as cloud platforms and SaaS vendors.
What are the main compliance pillars of DORA?
| Pillar | What it requires |
|---|---|
| ICT risk management | Formal policies, periodic risk assessments, and mitigation plans for all critical systems. |
| Incident reporting | Notify the competent authority within 4 hours of classifying an incident as major (no later than 24 hours after detection), then an intermediate report within 72 hours and a final report within one month. |
| Digital operational testing | Conduct regular vulnerability scans, penetration tests, and advanced testing like threat - led penetration testing. |
| Information sharing | Participate in the EU - wide cyber - information exchange platform for alerts and best practices. |
| Third - party oversight | Perform due - diligence, continuous monitoring, and contractual clauses for all ICT service providers. |
How can developers start preparing for DORA?
- Create an asset inventory - List every application, database, cloud service, and network component that supports financial functions.
- Classify critical assets - Use business impact analysis to mark systems whose failure would disrupt core services.
- Implement continuous monitoring - Deploy SIEM or CSPM tools that collect logs, alert on anomalies, and retain data for at least one year.
- Automate incident reporting - Build a template that pulls log excerpts and system status into the required initial - notification format, sendable within 4 hours of classification.
- Conduct regular testing - Schedule quarterly vulnerability scans and annual threat - led penetration tests; document findings and remediation steps.
- Review third - party contracts - Add clauses that require providers to meet DORA - level security controls and to notify you of incidents.
What are the penalties for non - compliance?
National competent authorities can impose administrative fines up to 2 % of the firm’s total worldwide annual turnover or €10 million, whichever is higher (with a separate periodic - penalty regime of up to 1 % of average daily turnover for critical ICT third - party providers). In addition, regulators may suspend or limit business activities until remedial actions are taken.
How does DORA relate to other EU regulations?
| Regulation | Focus | Overlap with DORA |
|---|---|---|
| GDPR | Personal data protection | Both require breach notification, but DORA is specific to ICT incidents affecting financial services. |
| MiFID II | Market transparency | DORA adds operational resilience requirements that complement MiFID II’s governance rules. |
| NIS2 | Cybersecurity for essential services | DORA adopts many NIS2 controls but is stricter for financial sector ICT risk management. |
Where can I find the official text?
The full regulation is published as Regulation (EU) 2022/2554 and can be downloaded from the European Commission’s EUR - LEX portal. Guidance documents are also available from the European Banking Authority (EBA) and the European Securities and Markets Authority (ESMA).
Final checklist for developers
- Asset inventory completed and classified.
- Risk management policy documented and reviewed annually.
- Incident response playbook includes the real reporting flow: 4 - hour initial notice, 72 - hour intermediate report, 1 - month final report.
- Automated monitoring and logging configured for all critical systems.
- Quarterly vulnerability scans and annual threat - led testing scheduled.
- Third - party contracts contain DORA - aligned security clauses.
By following these steps, you can turn DORA from a regulatory hurdle into a roadmap for stronger digital resilience.
Related guides
ISO 9001:2026 - What’s New, When It Arrives, and How to Prepare
ISO 9001:2026 was published 16 September 2026, adding quality culture, ethics and climate-change clauses while keeping the familiar 10-clause structure. The key changes, the transition timeline, and why ISO/IEC 27001 - not ISO 9001 - is the standard that actually covers information security.
What does DORA stand for and why does it matter?
DORA usually means the EU’s Digital Operational Resilience Act - a live, enforceable ICT risk and incident-reporting regulation for financial entities. What it actually requires, who it applies to, and why the same acronym gets used for a few unrelated things.
How ServiceNow Helps Financial Institutions Achieve DORA Compliance
ServiceNow's DORM app automates DORA's incident and third-party reporting workflow - but it manages risk data, it doesn't discover it. What ServiceNow actually covers, what DORA's real incident-reporting clock requires, and where a technical security scan fills the gap.