EU DORA — Digital Operational Resilience Act

Why does it matter?

DORA turns operational resilience from a collection of national and sector rules into one directly applicable regulation. It places the accountability for ICT risk on the management body and makes the financial entity fully responsible even when it relies on an ICT provider.

Key benefits include:

• Management body accountability

The management body defines, approves and oversees the ICT risk framework and bears ultimate responsibility for ICT risk (Article 5(2)).

• One incident reporting regime

Major ICT-related incidents are reported to the competent authority as an initial notification, intermediate report and final report using common templates (Articles 19 and 20).

• Tested resilience

Entities test ICT tools regularly, and those identified by authorities carry out threat-led penetration tests at least every three years (Articles 24 to 26).

• Third-party risk is contractual

Financial entities keep a register of information on all ICT contracts and include key provisions in every contract (Articles 28 and 30).

• Critical providers are overseen

The ESAs designate critical ICT third-party service providers and a Lead Overseer can impose periodic penalty payments of up to 1 percent of average daily worldwide turnover (Articles 31 and 35).

How does it work?

DORA has nine chapters. Chapter II covers ICT risk management, Chapter III incident management, Chapter IV digital operational resilience testing, Chapter V third-party risk and the oversight framework for critical providers, and Chapter VI information sharing (Article 45). Chapter VII covers competent authorities and penalties.

The ICT risk framework follows the lifecycle in Articles 7 to 14: identify assets and dependencies (Article 8), protect and prevent (Article 9), detect (Article 10), respond and recover (Article 11), back up and restore (Article 12), learn and evolve (Article 13) and communicate (Article 14). Small and non-interconnected firms, and microenterprises in some respects, follow a simplified framework (Article 16).

For third-party risk, an entity adopts a strategy, assesses each arrangement before contracting, checks concentration risk (Article 29), includes the Article 30 provisions on service descriptions, locations, data access and return, assistance in incidents, cooperation with authorities and termination rights, and reports on its register at least yearly.

Key Elements

• ICT risk management framework (Articles 5 to 16)

Governance by the management body, a documented framework, identification, protection, detection, response and recovery, backup, learning and communication, with a simplified framework in Article 16.

• Incident management and reporting (Articles 17 to 23)

A process to detect, manage and notify ICT-related incidents, classification of incidents and cyber threats (Article 18), and reporting of major incidents with voluntary notification of significant cyber threats (Article 19).

• Digital operational resilience testing (Articles 24 to 27)

A risk-based testing program, tests of ICT tools and systems (Article 25), threat-led penetration testing every three years for identified entities (Article 26) and requirements for testers (Article 27).

• ICT third-party risk (Articles 28 to 30)

A third-party risk strategy, the register of information on all contractual arrangements, due diligence, concentration risk and key contractual provisions, with extra terms for critical or important functions.

• Oversight of critical providers (Articles 31 to 44)

The ESAs designate critical ICT third-party service providers and appoint a Lead Overseer with powers to request information, investigate, inspect and issue recommendations.

• Penalties and cooperation (Articles 46 to 54)

Competent authorities, cooperation with the NIS2 structures (Article 47), administrative penalties and remedial measures (Article 50) and publication of penalties.

What does it cover?

DORA applies to the financial entities listed in Article 2(1), from credit institutions to administrators of critical benchmarks, and to ICT third-party service providers as the subject of the contractual and oversight rules. It does not apply to some exempt entities named in Article 2(3). The Regulation applies in proportion to the entity's size and risk profile (Article 4).

What are its objectives?

DORA aims at a high common level of digital operational resilience in the Union's financial sector.

Hold the management body accountable for ICT risk.

Manage ICT risk through a documented framework that covers identification, protection, detection, response, recovery and learning.

Report major ICT-related incidents with common templates.

Test resilience, with threat-led penetration tests for the entities identified.

Control ICT third-party risk by contract and oversee critical providers at Union level.

Framework in Context

DORA applies in addition to the sector law for financial entities and sits beside the NIS2 Directive, with Article 47 setting cooperation between the authorities under the two. Technical standards that the ESAs prepare, referred to in Articles 15, 18, 20, 26 and 28 to 30, give the detail on incident classification, reporting templates, testing and contract content.

Common Framework Mappings

Organizations commonly map EU DORA to complementary regulatory and technical frameworks to harmonize operational resilience, outsourcing, incident response, and information security controls across financial services compliance programs.

Mapped frameworks include:

EBA Guidelines on ICT and Security Risk Management

EBA Guidelines on Outsourcing Arrangements

ISO 22301

ISO/IEC 27001

NIS2 Directive

NIST Cybersecurity Framework

NIST SP 800-53

SWIFT Customer Security Controls Framework (CSCF)