Digital Operational Resilience Act (DORA) Legislation

All about the EU DORA Act

6/17/20264 min read

Strengthening the Financial Sector’s Digital Shield: An Overview of the Digital Operational Resilience Act (DORA)

The Digital Operational Resilience Act (DORA), or Regulation (EU) 2022/2554, establishes a comprehensive Union-wide framework to ensure that financial entities can withstand, respond to, and recover from all types of information and communication technology (ICT) related disruptions and threats. This regulation consolidates and upgrades ICT risk requirements that were previously scattered across various Union legal acts, creating a consistent Single Rulebook for digital resilience. While previous EU financial regulations contained ICT and operational risk requirements, these obligations were fragmented across sector-specific legislation. DORA creates a harmonized framework that places digital operational resilience at the centre of financial risk management, recognizing that ICT failures and cyber threats can pose systemic risks to financial stability.

Chapter I: Foundations, Scope, and Proportionality

Articles 1-4 define the regulation’s reach and core principles. DORA applies to a vast range of financial entities, including credit institutions, payment institutions, investment firms, insurance undertakings, and crypto-asset service providers. Notably, it also includes ICT third-party service providers.

A central pillar is the proportionality principle (Article 4), which mandates that entities implement requirements based on their size, risk profile, and the nature and complexity of their services. This ensures that while a high level of resilience is maintained, the burden remains manageable for smaller entities and microenterprises.

Chapter II: The ICT Risk Management Framework

Articles 5-16 require financial entities to maintain a sound, documented, and comprehensive ICT risk management framework. Key requirements include:

  • Governance (Article 5): The management body bears ultimate responsibility for managing ICT risk, setting the digital resilience strategy, and approving business continuity plans.

  • Identification and Protection (Articles 8-9): Entities must continuously identify sources of ICT risk, maintain inventories of ICT assets, and deploy robust security tools to ensure data availability, authenticity, integrity, and confidentiality.

  • Response and Recovery (Articles 11-12): Entities must establish ICT business continuity policies and restoration procedures to minimize downtime following disruptions.

  • Simplified Framework (Article 16): Smaller, non-interconnected investment firms and certain exempted institutions are subject to a simplified ICT risk management framework focused on essential protections and continuity measures.

Together, these requirements establish the foundation for a proactive ICT risk management framework that supports business continuity and operational resilience across financial entities.

Chapter III: Incident Management and Reporting

Articles 17-23 standardize how ICT incidents are handled.

  • Classification (Article 18): Incidents must be classified based on criteria such as the number of clients affected, duration, geographical spread, and economic impact.

  • Mandatory Reporting (Article 19): Financial entities must report major ICT-related incidents to their competent authorities. This reporting includes an initial notification, intermediate updates, and a final root-cause analysis. Voluntary notification is also encouraged for significant cyber threats.

Chapter IV: Digital Operational Resilience Testing

Articles 24-27 mandate regular testing of ICT systems to identify vulnerabilities.

  • General Testing (Article 25): Most entities must conduct a range of tests, such as vulnerability assessments, gap analyses, and network security assessments, at least once a year.

  • Advanced Testing (Article 26): Entities identified as having a significant systemic impact or high ICT maturity must perform threat-led penetration testing (TLPT) every three years. These "red team" tests must cover critical functions and be performed on live production systems.

Chapter V: Managing ICT Third-Party Risk

Articles 28-44 address the risks stemming from the sector's heavy reliance on external service providers.

  • Contractual Principles (Articles 28 & 30): Entities remain fully responsible for their regulatory obligations even when outsourcing. Contracts must include specific provisions, such as clear service level descriptions, data processing locations, and unrestricted rights of access and audit for the financial entity and its supervisor.

  • Union Oversight Framework (Articles 31-43): For the first time, critical ICT third-party service providers will be designated and subject to direct oversight by a Lead Overseer (one of the European Supervisory Authorities). The Lead Overseer has the power to conduct investigations, perform onsite inspections, and issue recommendations to address identified risks.

  • DORA recognizes that outsourcing ICT services does not outsource accountability. Financial entities remain responsible for managing ICT risks arising from third-party providers and must maintain effective oversight throughout the outsourcing lifecycle.

Chapters VI-IX: Information Sharing, Enforcement, and Final Provisions

  • Information Sharing (Article 45): Entities are encouraged to voluntarily exchange cyber threat intelligence within trusted communities to enhance collective defense.

  • Competent Authorities and Penalties (Articles 46-56): Member States must designate authorities with the power to impose administrative penalties and remedial measures for breaches of the regulation.

  • Implementation: DORA amends several existing regulations (e.g., EMIR, MiFIR, CSDR) to ensure legal consistency and enters into full application on 17 January 2025.

Operational Risk Perspective & Takeaways

For Operational Risk professionals, the ICT Risk Management Framework extends beyond ICT and cybersecurity. It requires governance, risk identification, business continuity, resilience testing, incident management and third-party oversight to operate as an integrated control framework rather than isolated compliance activities.

  • ICT risk becomes a Board-level governance responsibility requiring active oversight rather than delegated ownership.

  • Third-party ICT providers require ongoing oversight rather than periodic due diligence.

  • Incident reporting becomes more structured and standardized.

  • Operational resilience focuses on maintaining critical services during disruption, not merely preventing cyber incidents.

  • Regular resilience testing becomes a regulatory expectation rather than a best practice.

DORA represents one of the most significant developments in operational resilience for the European financial sector. Rather than treating ICT risk as solely a technology concern, the regulation embeds digital resilience into governance, operational risk management, third-party oversight and business continuity. For financial institutions, compliance with DORA is not merely a regulatory obligation—it is an opportunity to strengthen organizational resilience against an increasingly complex digital threat landscape. Ultimately, DORA shifts the conversation from compliance with ICT requirements to building resilient financial institutions capable of continuing critical services even in the face of significant digital disruption.

Portfolio

Showcasing my skills, education, and experiences online.

Connect

shubhamghotankar@gmail.com

+32 0465 86 03 92

© 2025. All rights reserved.