Digital Operational Resilience Act (DORA)

Regulation 2022/2554 on digital operational resilience for the financial sector

Background and Scope

The Digital Operational Resilience Act (DORA) is an EU regulation designed to enhance the digital operational resilience of financial institutions. Effective from 17 January 2025, DORA ensures that banks, insurance companies, investment firms, and other financial entities can withstand, respond to, and recover from ICT (Information and Communication Technology)-related disruptions, including cyberattacks and system failures.

DORA establishes comprehensive cybersecurity requirements across the EU financial sector, applying to a broad range of financial entities, including banks, investment firms, and payment service providers. Additionally, the regulation establishes a supervisory framework for critical ICT third-party providers, such as cloud service providers, ensuring oversight of the technology infrastructure supporting financial services. Implementation of DORA will be complemented by a set of delegated regulations that provide detailed technical standards and operational requirements.

Digital Omnibus Regulation Proposal

In its Digital Omnibus Regulation Proposal, the Commission proposed that ENISA shall establish an EU-wide entry point for incident reporting under several EU regulations, including eIDAS, DORA, NIS2, CER Directive, and GDPR. The purpose is to reduce administrative burdens for businesses and enable a more focused approach to incident reporting.

Key Obligations

• ICT risk management: DORA mandates financial entities to establish robust frameworks to protect their operations and sensitive data from cyber threats. This includes implementing comprehensive measures such as ICT risk assessments, ICT governance policies and adequate security controls.
• Incident management: Financial entities must establish comprehensive incident management processes to detect, manage, and notify ICT-related incidents. Additionally, all ICT-related incidents and significant cyber threats must be systematically recorded and documented.
• Incident reporting: Financial entities must report ICT-related incidents to relevant authorities, enabling swift response and mitigation efforts. Timely reporting is intended to help minimise the impact of such incidents and enhance overall sector resilience.
• Third-party risk management: DORA establishes comprehensive rules on third-party risk management requirements. With the exception of micro-enterprises, all financial entities must implement a vendor risk strategy meeting specific regulatory criteria, maintain a comprehensive registry of ICT services utilised, and submit annual reports to supervisory authorities detailing new contracts and planned ICT service agreements for critical functions.
• Due diligence: Prior to entering into contractual arrangements with third-party ICT providers, financial entities must conduct comprehensive due diligence evaluations and ensure such providers comply with appropriate information security standards.
• Contractual requirements: DORA establishes minimum key contractual elements that financial entities must include in all contractual arrangements with third-party ICT providers.