Digital Operational Resilience Act (DORA).

What Is the Digital Operational Resilience Act (DORA)?

The Digital Operational Resilience Act is an EU law for the financial sector. Its formal name is Regulation (EU) 2022/2554. The EUR-Lex summary says it sets the same rules for the security of the network and information systems of banks, insurers and investment firms. These firms must withstand, answer and recover from any disruption or threat that involves information and communication technologies (ICT).

Who Adopted DORA, and When Did It Apply?

The European Parliament and the Council adopted it in a regulation dated 14 December 2022. EUR-Lex, the official site for EU law, publishes the full text. The European Securities and Markets Authority (ESMA) keeps a page on the rollout. It gives the dates below.

Dates come from the ESMA DORA page, the first-batch announcement and the second-batch announcement.

Which Firms Fall Under DORA?

The EUR-Lex summary says the regulation covers a wide range of EU regulated financial entities. Its list includes:

• credit, payment, electronic money and occupational pension institutions;
• service providers for account information, crypto assets, data reporting, crowdfunding and ICT third parties;
• investment firms, alternative investment funds, management companies, credit rating agencies and administrators of critical benchmarks;
• trade and securitisation repositories, central securities depositories, central counterparties and trading venues;
• insurance, insurance intermediaries and reinsurance businesses.

The summary says some requirements apply to financial entities other than microenterprises. The regulation text is the place to check exact scope.

What Are the Main Areas of DORA?

Article 1 of the regulation sets requirements for financial entities on ICT risk management and on reporting of major ICT-related incidents. The EUR-Lex summary groups the content into these areas.

• ICT risk management. This covers governance, monitoring of ICT systems, and business continuity and backup policies.
• Incident management and reporting. Financial entities must detect, manage, record and notify ICT-related incidents, and report major ones to their competent authority.
• Digital operational resilience testing. The summary says entities other than microenterprises must keep a testing program.
• ICT third-party risk. Financial entities must manage third-party risk as part of their overall ICT risk, including contractual arrangements for ICT services.
• Information sharing. The summary says financial entities may exchange cyber-threat information among themselves, under conditions it sets out.

Where Do ICT Providers Fit in?

The summary lists ICT third parties among the service providers in scope. It also describes an oversight framework for critical ICT third-party service providers. Under it, the European Supervisory Authorities pick the providers they consider critical, using clear criteria. They appoint a lead overseer for each.

Which Terms Sit Next to DORA?

Third-party risk is the chance that a problem at a supplier harms the organization that relies on it. DORA names it as one of its main areas. Penetration testing is a controlled test that imitates an attack, and the summary mentions threat-level penetration testing within the testing area. An incident response plan is a written set of steps for handling a security incident.

Is DORA the Same as NIS2?

No. They are separate EU laws. DORA is a regulation for the financial sector, numbered 2022/2554. NIS2 is a directive on cybersecurity, numbered 2022/2555. Read our NIS2 page for it. Our blog has more on DORA, what the ESAs say about DORA in 2026 and NIS2 and DORA third-party risk. For supplier checks, see supply chain and vendor risk.

Where Can I Read the Official Text?

The full regulation is on EUR-Lex under CELEX number 32022R2554, and EUR-Lex also publishes a summary. This page is not legal advice and does not say whether a firm is covered.