Short answer: DORA compliance is an ongoing operational-resilience program, not a certificate or one-time audit. Regulation (EU) 2022/2554 has applied directly across the EU financial sector since 17 January 2025. Covered organizations must govern ICT risk, report major ICT incidents, test resilience, control technology suppliers, maintain prescribed records and cooperate with supervision. The regulation is available at EUR-Lex.
What DORA is—and what it is not
The Digital Operational Resilience Act (DORA) is an EU regulation for financial-sector digital and operational resilience. Unlike a directive, it did not require national transposition: its requirements apply directly in Member States from 17 January 2025. It harmonizes governance, ICT-risk management, incident handling, resilience testing, third-party controls and information sharing that were previously spread across sector rules and supervisory guidance.
DORA does not replace GDPR, NIS2 where applicable, payment-services rules, insurance or banking outsourcing requirements, national law or contracts. A control can satisfy one framework while leaving DORA obligations—such as a required exit plan or register of ICT arrangements—unmet.
The European Commission’s current implementing and delegated-acts page lists adopted Level 2 measures, including Delegated Regulation (EU) 2025/301 on major-incident reporting, 2025/420 on joint examination teams and 2025/532 on subcontracting ICT services supporting critical or important functions. Check the Commission list for status before relying on draft guidance: European Commission DORA acts.
Quick wins for a faster PC:
Clear out junk files and repair common Windows errorsFree Scan →Scan for outdated or missing drivers - takes under a minuteDriver Scan →Who is in scope?
Article 2 and sector definitions determine scope. The checklist below identifies commonly covered categories; the exact legal classification must be confirmed for each entity and jurisdiction.
- Credit, payment and electronic-money institutions.
- Investment firms, trading venues, central securities depositories and central counterparties.
- Insurance and reinsurance undertakings and relevant intermediaries.
- Crypto-asset service providers and certain issuers under the Markets in Crypto-Assets framework.
- Alternative-investment-fund and UCITS management companies in relevant circumstances.
- Credit-rating agencies, administrators of critical benchmarks, crowdfunding providers, securitisation and trade repositories, data-reporting service providers and certain pension and financial-market entities.
A technology supplier is not automatically a DORA-regulated financial entity merely because it serves a bank. It may be affected indirectly through customer contracts, or directly if the European Supervisory Authorities designate it a critical ICT third-party provider. A provider’s “DORA compliant” marketing claim never makes its customer compliant.
Non-EU firms can be affected through EU entities, branches, regulated activities or contracts, but geography alone does not determine coverage.
What “DORA compliant” should mean in practice
A defensible description is: the organization can demonstrate that its governance, ICT controls, incident processes, resilience tests, supplier arrangements, records and remediation satisfy the DORA provisions and applicable technical standards for its entity.
There is no universal pass/fail certificate. Proportionality depends on entity type, size and complexity, risk profile, critical or important functions, group structure, ICT use, simplified-framework eligibility and supervisory expectations. The management body remains accountable even when work is delegated.
The six DORA pillars
1. ICT-risk governance and management
The board or management body approves and oversees the ICT-risk framework, sets risk appetite and tolerance, receives meaningful reporting, maintains relevant skills through training and challenges remediation. Operational ICT, control functions and internal audit should have appropriately separated responsibilities.
Except for microenterprises, the framework must be documented and reviewed at least annually, after major ICT incidents and after relevant supervisory or testing conclusions. It should connect technology to business services rather than treating DORA as an IT checklist.
2. ICT-risk controls and evidence
A functioning framework normally covers identification and assessment of ICT risk; asset and information inventories; business-function classification; identity, authentication and privileged access; cryptography and key management; secure change, patch and vulnerability management; logging and detection; backup and restoration; disaster recovery; continuity and crisis management; physical security; capacity; secure development; post-incident review; independent assurance; and supplier risk.
Useful evidence includes:
- ICT-risk policy, risk appetite and tolerance statement.
- Current business-service, information-asset and ICT-asset inventories with dependency maps.
- Access, vulnerability, patch, logging, backup and recovery records.
- Continuity, disaster-recovery and crisis-communication plans.
- Incident register, root-cause analyses and corrective-action tracking.
- Testing calendar, reports, retests and board or committee minutes.
- Vendor assessments, contracts, subcontractor records and exit strategies.
- Internal-audit reports, management attestations and remediation decisions.
3. ICT-related incidents and reporting
Maintain one process that records all ICT incidents and significant cyber threats, classifies them using materiality criteria and escalates major incidents to senior management and the management body. The workflow is:
- Detect and preserve evidence.
- Triage impact on services, clients, transactions and data.
- Classify severity and determine whether the incident is major.
- Escalate, contain and communicate with affected stakeholders.
- Submit the initial regulatory notification when the applicable trigger is met.
- Provide intermediate updates as material facts or status change.
- Recover, complete the final report, analyse root cause and track corrective action.
Classification considers affected clients or counterparties, transaction number or value, duration and downtime, geographic spread, availability/authenticity/integrity/confidentiality impacts, affected-service criticality, economic impact and reputational effects. Delegated Regulation (EU) 2025/301 sets the reporting framework and forms; deadlines must be applied from its text to the entity’s awareness and classification point, incident type and competent-authority channel rather than reduced to a generic “24-hour” or “72-hour” slogan. See the regulation at EUR-Lex 2025/301.
Do not wait for complete forensic certainty. Prepare a useful first notification and update it as facts develop; document what prevented immediate completion if the prescribed template cannot be used.
4. Digital-operational-resilience testing
Use a risk-based program tied to business services. It can include scanning and vulnerability assessments, network and physical-security reviews, software and open-source analysis, scenario exercises, end-to-end tests, continuity and recovery exercises, crisis simulations and penetration testing. Every test should record scope, objectives, assumptions, independence, findings, residual-risk acceptance, owners, deadlines, retests and governance reporting.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Threat-led penetration testing (TLPT) is a deeper, intelligence-led exercise against live or production-relevant systems—not ordinary scanning. Applicability depends on the entity and supervisory criteria; it is not an annual universal requirement. Where internal testers are used in permitted circumstances, DORA requires external testers at least every third test. Relevant ICT providers may need to cooperate. The primary legal text is DORA, Regulation (EU) 2022/2554.
5. ICT third-party risk
Maintain an inventory of ICT providers and map each service to critical or important functions, data, locations, subcontractors and recovery requirements. Assess concentration and single-provider risk, monitor service levels, require incident cooperation and keep contract-renewal and remediation records.
For services supporting critical or important functions, contracts should address service descriptions and measurable levels; security; incident notification; continuity and contingency plans; resilience-test participation; monitoring and audit rights; competent-authority access and inspection cooperation; subcontracting controls; termination; transition and migration assistance. A SOC 2 report, ISO 27001 certificate or penetration-test report can support evidence, but none proves that your functions, clauses, dependencies and exit risks satisfy DORA.
6. Information sharing and critical-provider oversight
DORA permits and encourages trusted sharing of threat intelligence, vulnerabilities, indicators of compromise, tactics and mitigations, subject to confidentiality, secrecy, privacy and legal review. Voluntary threat sharing is distinct from mandatory major-incident reporting.
Outdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchWindows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstallThe EBA, EIOPA and ESMA participate in EU oversight of ICT providers designated critical, with a Lead Overseer. Designation considers systemic impact, reliance by financial entities and consequences of a large-scale failure. Ordinary cloud or SaaS suppliers are not automatically designated. See the EBA overview at EBA DORA oversight.
Simplified framework: smaller does not mean exempt
Article 16 provides a simplified ICT-risk-management framework for eligible entities. Eligibility depends on legal category and risk conditions, not simply headcount. The entity still needs documented controls, monitoring, incident handling, continuity, testing and supplier oversight proportionate to its risk. Record the eligibility decision and reassess it after material changes. See Article 16 in DORA.
How to perform a DORA gap assessment
- Confirm scope: entity category, jurisdictions, competent authority, group perimeter and simplified-framework or TLPT status.
- Map services: identify critical and important functions, supporting applications, infrastructure, data, facilities, people, providers and subcontractors.
- Test each domain: governance, ICT controls, incidents, continuity, testing, contracts, register fields, board reporting, audit and TLPT.
- Score gaps: record requirement, evidence, owner, affected service, risk, deadline, dependency and residual-risk decision.
- Validate with leadership: obtain management approval for priorities, funding and accepted risk.
The result should be a risk-ranked remediation register, not a color-coded checklist with no accountable owner.
The DORA register of information
The register is a structured record of contractual arrangements for ICT services—not a simple vendor list. It links providers and services to functions, entities, arrangements, locations, subcontracting and risk. Maintain it at entity, sub-consolidated and consolidated levels where relevant and make it available to the competent authority on request. The EBA provides preparation material at EBA register preparation.
Assign an owner, define source systems, validate changes with procurement and architecture teams, and reconcile the register after acquisitions, new outsourcing, renewals or material service changes.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Cloud providers, concentration and exit
For each important cloud or SaaS dependency, identify regions, data flows, upstream providers, recovery objectives, portability constraints and concentration exposure. Contractual audit rights are useful only if they can be exercised, and a backup is not an exit strategy unless the organization can migrate and operate within its tolerance.
Document alternative providers, transition periods, data-export formats, operational skills, communications and tested fallback arrangements. Subcontractor visibility matters because a provider’s resilience can depend on another provider the customer cannot directly see.
Do ISO 27001, SOC 2, NIS2 or NIST satisfy DORA?
| Framework or evidence | What it can reuse | What still needs DORA-specific treatment |
|---|---|---|
| ISO 27001 | Information-security governance, risk and audit evidence. | Financial-service mapping, incident reporting, register of arrangements, contractual access and exit, proportionality and testing obligations. |
| SOC 2 | Control descriptions and independent assurance for stated services and periods. | Your critical functions, DORA classifications, supervisory access, subcontractors, staged reporting and recovery evidence. |
| NIS2 | Cybersecurity, incident and supply-chain practices where scopes overlap. | Financial-sector governance, DORA register, TLPT applicability and financial supervisory processes. |
| NIST or internal standards | Control design, risk analysis and technical procedures. | Legal applicability, management-body duties, DORA contracts, reporting and regulator access. |
Choosing software, GRC or outside help
| Approach | Best fit | Trade-offs |
|---|---|---|
| Spreadsheets and documents | Small, stable organization with few providers and strong owners. | Version-control, stale records, duplicate entry and weak dependency workflows. |
| Compliance automation platform | Cloud-heavy teams needing evidence collection, integrations and multiple frameworks. | Does not decide risk appetite, criticality, governance or recovery; mappings require validation. |
| Enterprise GRC or integrated risk platform | Large groups with existing CMDB, procurement, audit and group reporting. | Longer implementation and administration; can become a passive document repository. |
| Consultant, auditor or managed service | Contract remediation, complex recovery, independent assurance, TLPT or supervisory preparation. | Cost, knowledge dependency, generic templates and possible independence conflicts. |
Official pages for Vanta, Drata and Sprinto describe DORA mappings, evidence automation, vendor-risk and integrations, but present personalized or quote-based pricing: Vanta DORA, Vanta pricing, Drata plans and Sprinto pricing. Treat these as tools, not legal determinations.
Recommended Free Tools
Ask any vendor whether it supports entity, sub-consolidated and consolidated registers; maps providers to functions; tracks subcontractors, clauses, audit rights and exits; handles staged incident reporting; records tests and retests; exports data; and separates subscription, implementation, integration, advisory and testing costs. The regulated entity retains responsibility.
Six-phase implementation roadmap
- Scope and govern: approve a scope memo, responsibility matrix, executive sponsor and board reporting route.
- Map: produce service, asset, dependency, provider and subcontractor inventories.
- Assess: compare controls and contracts with DORA, rank gaps and assign deadlines.
- Build: implement incident classification, recovery, access, monitoring, contracts, exits, crisis communications and evidence workflows.
- Test: run tabletop, recovery, provider-failure, outage and appropriate penetration tests; perform TLPT when applicable.
- Operate: review the framework, update the register, reassess functions and providers, track incidents and report metrics continuously.
Common mistakes to avoid
- Calling DORA an IT checklist instead of a business-service resilience program.
- Assuming ISO 27001, SOC 2 or a vendor platform equals compliance.
- Waiting until contract renewal to seek audit, incident, subcontracting or exit rights.
- Keeping only a vendor name without arrangement, function, dependency and group-level data.
- Testing plans without proving restoration and data integrity.
- Confusing vulnerability scanning with TLPT.
- Waiting for complete incident facts before staged escalation.
- Ignoring business owners, procurement, legal, continuity and internal audit.
- Buying software before defining the control model and ownership.
- Advertising or buying a nonexistent universal “DORA certification.”
DORA compliance checklist
- Scope and competent authority confirmed.
- Management-body accountability, training and reporting documented.
- ICT-risk framework, inventories and dependency maps current.
- Critical and important functions identified with tolerances.
- Incident register, classification and staged notification process exercised.
- Continuity, backup, restoration and crisis plans tested.
- Risk-based testing calendar and TLPT decision documented.
- Provider, subcontractor, concentration and exit risks assessed.
- Contracts contain required security, reporting, audit, access, continuity and migration terms.
- Register of information reconciled at applicable group levels.
- Findings, residual risk, owners, deadlines and retests tracked.
- Framework reviewed after material incidents, testing findings and major changes.
Regulatory status: As of 18 August 2026, DORA is already applicable and adopted Level 2 measures continue to shape operating detail. Recheck the Commission’s current Level 2 list and the applicable authority’s reporting instructions before filing or changing controls.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
