DORA compliance,
pillar by pillar.

The Digital Operational Resilience Act is Regulation (EU) 2022/2554. As a regulation it applies directly in every member state without national transposition, and it has applied since 17 January 2025. It is supported by regulatory and implementing technical standards that set out the detail, such as the incident reporting deadlines and the register of information templates.

DORA's aim is that a financial entity can withstand, respond to and recover from ICT disruption, whether the cause is a cyberattack, a failed change or the outage of a cloud provider. Where DORA applies, its ICT risk and incident rules take precedence over the general NIS2 requirements for the same entities.

Article 2 lists twenty types of financial entity, including credit institutions, payment institutions, account information service providers, electronic money institutions, investment firms, crypto-asset service providers, central securities depositories, central counterparties, trading venues, managers of alternative investment funds, UCITS management companies, insurance and reinsurance undertakings and intermediaries, occupational pension institutions, credit rating agencies, administrators of critical benchmarks and crowdfunding service providers. It also covers ICT third-party service providers, which are subject to the oversight framework if designated as critical.

For SaaS and cloud companies, including US ones: if you sell to EU financial entities, DORA reaches you through their contracts even if you are never designated critical. Expect DORA clauses (Article 30), requests for information for their register, incident notification duties, audit and access rights, participation in their testing, and exit assistance. Our DORA applicability checker gives a first answer.

Article 5 puts the management body in charge: it defines, approves and oversees the ICT risk management framework, bears ultimate responsibility for ICT risk, approves the digital operational resilience strategy, and must keep its own ICT risk knowledge up to date. Article 6 requires a sound, comprehensive and well-documented framework within the overall risk management system, protecting information and ICT assets and the physical infrastructure they depend on.

Articles 8 to 14 then set out the working parts: identify and classify ICT assets, functions and dependencies; protect and prevent; detect anomalies; respond and recover with business continuity and disaster recovery plans; back up and restore; learn from incidents; and communicate. A financial entity running ISO 27001 will recognise most of it, but DORA is more prescriptive on governance, ICT business continuity and third-party dependencies. A risk assessment and register is the usual starting point.

Financial entities stay fully responsible for compliance when they use ICT providers. Article 28 requires a strategy on ICT third-party risk, an assessment before entering a contract, and a register of information on all contractual arrangements for ICT services, distinguishing those that support critical or important functions. Entities report on new arrangements to their competent authority at least yearly and must provide the full register on request. The first registers were collected by the authorities and passed to the European Supervisory Authorities by 30 April 2025.

Article 30 lists the key contractual provisions: a clear description of services and locations, data protection and access, service levels, incident assistance, cooperation with authorities, termination rights and, for critical or important functions, further terms on reporting, business continuity, participation in TLPT, audit rights and exit strategies. Our vendor risk management guide covers the general process of tiering and reviewing suppliers.

The European Supervisory Authorities (EBA, EIOPA and ESMA), acting through their Joint Committee, designate ICT providers as critical based on systemic impact, the importance of the financial entities relying on them, reliance for critical functions, and how hard they are to substitute. Each critical provider gets a Lead Overseer that can request information, run investigations and inspections, and issue recommendations, including on subcontracting. Non-cooperation can bring a periodic penalty payment of up to 1% of the provider's average daily worldwide turnover, imposed daily for up to six months. The ESAs' roadmap set designation and the start of oversight for 2025; check the ESAs' published list for which providers are designated.

For financial entities, DORA does not set a single EU fine. Member states lay down administrative penalties and remedial measures, and may add criminal penalties; competent authorities can require access to documents, carry out inspections and order corrective action, and administrative penalties can be published. The fixed EU-level figure is the periodic penalty payment for critical ICT providers described above.

1. Confirm you are a financial entity under Article 2, or an ICT provider serving them, and whether the simplified framework applies.
2. Have the management body approve the ICT risk management framework and resilience strategy.
3. Map critical or important functions and the ICT assets and providers behind them.
4. Classify incidents and set up reporting to the 4-hour, 24-hour, 72-hour and one-month deadlines.
5. Run a testing programme; prepare for TLPT if your authority identifies you.
6. Build the register of information and bring ICT contracts up to Article 30.
7. Write exit strategies for providers supporting critical or important functions.

No. DORA is not a modelled framework in TryTrustable, and we do not claim DORA coverage. Some general capabilities help with work that DORA also asks for: a vendor register with tiers, reviews and evidence on file, a risk register, incident management, and modelled ISO 27001 and NIS2 requirements on a shared control library. The platform does not build a DORA register of information, compute DORA reporting deadlines or run TLPT. If DORA is your primary obligation, use this guide alongside specialist advice.