Digital Operational Resilience Act (DORA)

Five Core Pillars of DORA Compliance

1. ICT Risk Management (Chapter 2, Articles 6-16)

It requires financial entities to establish an ICT risk management framework to identify, assess, manage, and mitigate ICT-related risks across the organisation. It mandates that this framework is properly documented and reviewed on a regular basis, at least annually, so it remains aligned with changing systems, threats, and dependencies. It encourages financial entities to take proactive steps by defining a clear risk tolerance for ICT disruptions and addressing vulnerabilities early through preventive and detective controls, supported by practical response, backup, and continuity arrangements.

2. Incident management and reporting (Chapter 3, Articles 17-23)

DORA mandates that financial entities report major ICT-related incidents to the relevant competent authorities. It states that financial entities must implement processes and systems to detect, manage, and record all ICT-related incidents and significant cyber threats. The impact of incidents must be classified using consistent criteria such as severity, duration and downtime, geographical spread, affected services or clients, data impact, and economic losses. Along with this, reports should include clear information on the nature of the incident, the cause where known, the impact on operations and customers, and the measures taken to contain the incident and restore services, with updates provided as the situation develops and a final report once resolved.

In practice, the challenge is not only what to report, but how fast a financial entity can classify and submit staged reports with a clear audit trail. European supervisory authorities have finalised incident reporting notification timeline as three step process:

• Initial notification: as early as possible within 4 hours of classifying the incident as major, and no later than 24 hours from detection
• Intermediate report: submit within 72 hours (and provide further updates when the incident status/handling changes materially).
• Final report: within 1 month submit within 1 month, with full detail on root cause, impact, and remediation.

The Regulation highlights the importance for a threat to be notified quickly and reported once the full root-cause analysis is complete.

3. Digital operational resilience testing (Chapter 4, Articles 24-27)

DORA states that financial entities must perform regular and periodic testing of their ICT systems, processes, and controls as part of a digital operational resilience testing programme. These tests has to be carried out by independent parties, either internal or external, and may include activities such as vulnerability assessments, network security assessments, scenario-based testing, and gap analyses. Financial entities that fall under the advanced testing requirements are mandated to perform Threat-Led Penetration Testing (TLPT), which simulates realistic attack scenarios and assesses the effectiveness of controls and response capabilities, and this should be conducted at least every three years.

4. ICT third-party risk management (Chapter 5, Articles 28-44)

Chapter 5 of DORA requires financial entities to manage ICT third-party risk through stronger due diligence and oversight of service providers, especially where outsourced services support important or critical functions. DORA uses the concept of “critical or important functions” as a practical threshold for when ICT dependencies require the strongest governance, contractual, and exit controls, and a function is considered critical or important if its disruption would materially impair financial performance, the continuity/soundness of services, or ongoing compliance with authorisation and regulatory obligations as stated in Article 3(22) of the Act. DORA expects firms to reduce risks arising from third parties by assessing providers upfront and monitoring them on an ongoing basis. Financial entities must also provide the competent authorities with an annual overview of their ICT outsourcing, including the number of new ICT service arrangements, the types of ICT providers used, the contractual arrangement categories, and which ICT services or functions those providers’ support. They must ensure robust contracts are in place, covering key areas such as security and data protection, incident support and cooperation, access and audit rights, subcontractor controls, and clear exit or termination arrangements. To evidence compliance in a supervisory review, firms typically demonstrate the following core artefacts and controls aligned to Chapter 5 requirements:

ICT dependency mapping and documentation (as per Article 8)

• Classify and document ICT-supported business functions and their dependencies
• Identify and document processes dependent on ICT third-party service providers, including interconnections supporting critical or important functions
• Maintain inventories of those dependencies

Third-party register and upfront criticality assessment

• Article 28(3) states duty of financial entities to keep a register of all ICT third-party arrangements and distinguish those supporting critical or important functions
• Assess upfront whether an arrangement supports a critical or important function Article 28(4)(a).

Enhanced controls and contractual requirements for critical or important functions

• Article 28(3) requires financial entities to maintain a register of ICT third-party arrangements and identify those supporting a critical or important function; where this applies, financial entities must implement stronger controls, including exit strategies
• Ensure enhanced contractual protections, including baseline contract elements and additional requirements for critical or important functions as per Article 30(2) and Article 30(3) of the Act.

5. Information sharing (Chapter 6, Article 45)

Article 45 of DORA encourages financial entities to exchange cyber threat information and intelligence amongst themselves to strengthen digital operational resilience. This can include sharing practical items such as threat indicators, tactics and techniques, alerts, and defensive measures, typically through trusted communities or formal information-sharing arrangements. These arrangements should be governed by clear participation conditions and appropriate safeguards, and financial entities must notify the competent authorities when they join information-sharing arrangement. The aim is to help firms detect threats earlier and respond more consistently across the sector, while ensuring that any sharing is done responsibly and in line with confidentiality, data protection, and other legal obligations.