Digital Operational Resilience Act (DORA).

What is the Digital Operational Resilience Act (DORA)?

The Digital Operational Resilience Act is a European Union regulation. Its formal name is Regulation (EU) 2022/2554 on digital operational resilience for the financial sector. The EUR-Lex summary says it lays down uniform rules on the security of network and information systems of financial entities, such as banks, insurance companies and investment firms. It requires them to withstand, respond to and recover from any disruption or threat involving information and communication technologies, which are often shortened to ICT.

Who issued DORA?

The European Parliament and the Council of the European Union adopted it in a regulation dated 14 December 2022. EUR-Lex is the official site for EU law and publishes the full text.

Who does DORA apply to?

The EUR-Lex summary says the regulation covers a wide range of EU regulated financial entities. Its list includes:

• credit, payment, electronic money and occupational pension institutions;
• service providers for account information, crypto assets, data reporting, crowdfunding and ICT third parties;
• investment firms, alternative investment funds, management companies, credit rating agencies and administrators of critical benchmarks;
• trade and securitisation repositories, central securities depositories, central counterparties and trading venues;
• insurance, insurance intermediaries and reinsurance businesses.

The summary says some requirements apply to financial entities other than microenterprises. The regulation text is the place to check exact scope.

What does DORA broadly ask for?

Article 1 of the regulation sets requirements for financial entities on ICT risk management and on reporting of major ICT-related incidents. The EUR-Lex summary groups the content into these areas.

• ICT risk management. This covers governance, monitoring of ICT systems, and business continuity and backup policies.
• Incident management and reporting. Financial entities must detect, manage, record and notify ICT-related incidents, and report major ones to their competent authority.
• Digital operational resilience testing. The summary says entities other than microenterprises must keep a testing program.
• ICT third-party risk. Financial entities must manage third-party risk as part of their overall ICT risk, including contractual arrangements for ICT services.
• Information sharing. The summary says financial entities may exchange cyber-threat information among themselves, under conditions it sets out.

Does DORA apply to technology providers?

The summary lists ICT third parties among the service providers in scope. It also describes an oversight framework for critical ICT third-party service providers. Under it, the European Supervisory Authorities designate the providers considered critical, on the basis of clear criteria, and appoint a lead overseer for each.

How does DORA relate to nearby terms?

Third-party risk is the chance that a problem at a supplier harms the organization that relies on it. DORA names it as one of its main areas. Penetration testing is a controlled test that imitates an attack, and the summary mentions threat-level penetration testing within the testing area. An incident response plan is a written set of steps for handling a security incident. These are related terms only.

Is DORA the same as NIS2?

No. They are separate EU laws. DORA is a regulation for the financial sector, numbered 2022/2554. NIS2 is a directive on cybersecurity, numbered 2022/2555.

Where can I read the official text?

The full regulation is on EUR-Lex under CELEX number 32022R2554, and EUR-Lex also publishes a summary. This page is a plain description of what the official pages say. It is not legal advice, and it does not say whether any organization is covered.