What is DORA and why does it matter for digital - operational resilience?

Decloak is an AI-powered web security intelligence platform that scans a site's HTTP/TLS posture, JavaScript, and third-party scripts to produce a report anyone can read. This guide is part of Decloak's library of practical, source-backed security guidance.

Key takeaways

• DORA (Digital Operational Resilience Act) is an EU regulation that applies to ~20 types of financial entities and their ICT service providers.
• It becomes enforceable on 17 January 2025; penalties can reach 2 % of global turnover or €10 million.
• The law is built on five pillars: ICT risk - management, incident reporting, resilience testing, third - party risk management, and information - sharing.
• Requirements are proportional - smaller firms get simplified obligations.
• Compliance means documented governance, regular testing (including TLPT for large firms), and continuous monitoring of vendors.

What is DORA?

DORA stands for Digital Operational Resilience Act, an EU regulation (Regulation (EU) 2022/2554) that creates a binding framework for the digital - operational resilience of financial entities and their ICT service providers. It was published on 27 December 2022 and becomes applicable on 17 January 2025.

Who must comply with DORA?

The regulation covers around twenty categories of financial institutions - banks, insurers, investment firms, payment - service providers, crypto - asset service providers and more - as well as the ICT third - party providers that serve them. Both the primary entity and the ICT provider are subject to the same set of obligations.

What are the five pillars of DORA obligations?

1. ICT risk - management framework - Organizations must identify, protect, detect, respond to and recover from ICT risks, with governance resting on the management body (Art 5 - 16).
2. Incident reporting - Major ICT incidents must be classified and reported to the national competent authority within 4 hours of classification (and no later than 24 hours after first becoming aware of it), followed by an intermediate report within 72 hours and a final report within one month.
3. Digital - operational - resilience testing - Regular vulnerability assessments and penetration tests are required; “significant” entities must also perform Threat - Led Penetration Testing (TLPT) at least every three years.
4. ICT third - party risk management - Continuous monitoring of ICT providers, contractual audit rights, exit strategies, and maintenance of a Register of Information (RoI) are mandated.
5. Information - sharing - Entities are encouraged to voluntarily join sector - wide threat - intelligence sharing arrangements (Art 45).

How is DORA enforced?

National competent authorities (NCAs) supervise entities in each Member State, while the European Supervisory Authorities (EBA, ESMA, EIOPA) coordinate EU - wide oversight, especially for Critical Third - Party Providers (CTPPs). Penalties can reach 2 % of worldwide turnover or €10 million (whichever is higher) for serious breaches, daily penalties up to 1 % of average daily worldwide turnover for CTPPs, and personal fines up to €1 million for senior managers.

What technical standards support DORA?

The European Supervisory Authorities and ENISA have published Regulatory Technical Standards (RTS) that define ICT risk - management tools, incident - classification categories, reporting processes, TLPT methodology, third - party policy, subcontracting requirements and the Register of Information. These RTS documents provide the detailed technical specifications that organizations must follow.

How does proportionality affect compliance?

DORA scales obligations to an entity’s size, risk profile and complexity (Art 4). Micro - enterprises may use a simplified ICT risk - management framework (Art 16) and have reduced testing obligations, while larger firms must meet the full set of requirements.

Practical steps to start DORA compliance

1. Map scope - Identify all financial activities and ICT service providers that fall under DORA.
2. Establish governance - Assign responsibility to the senior management body and create an ICT risk - management policy.
3. Implement a risk register - Document identified ICT risks, mitigation measures and ownership.
4. Set up incident reporting - Define classification criteria, create an incident response playbook, and configure notification timelines (initial notice within 4 hours of classification, no later than 24 hours after detection).
5. Schedule testing - Plan regular vulnerability scans and penetration tests; for significant entities, schedule TLPT every three years.
6. Audit third - party contracts - Add clauses for audit rights, exit strategies and maintain an up - to - date Register of Information.
7. Join information - sharing forums - Participate in industry threat - intelligence groups to meet the voluntary information - sharing pillar.

Why should financial firms care now?

Non - compliance can lead to multi - million - euro fines, reputational damage and operational disruption. Moreover, the regulation drives a higher baseline of cyber - resilience across the financial sector, reducing systemic risk. Early preparation lets firms spread the effort, avoid rush - hour compliance costs and demonstrate to regulators a proactive security posture.

How does DORA relate to broader compliance frameworks?

DORA’s control set overlaps with many existing standards - ISO 27001, NIST CSF, and the upcoming NIS2 directive - but it adds sector - specific requirements for incident reporting timelines, TLPT and third - party monitoring. Mapping DORA obligations to these frameworks can simplify audit preparation and reduce duplicate work.