EU - DORA

Law Overview

Digital Operational Resilience Act (DORA)

The EU Digital Operational Resilience Act (DORA) sets out comprehensive rules for ensuring that financial institutions can withstand, respond to, and recover from ICT disruptions and cyberattacks.

Officially enacted as Regulation (EU) 2022/2554, DORA entered into force in January 2023 and became fully enforceable on January 17, 2025. It creates a unified cybersecurity and operational resilience framework across the EU financial sector, reducing fragmentation and increasing digital resilience for the European financial system as a whole.

This is some text inside of a div block.

Name

Digital Operational Resilience Act (DORA)

Type

Statutory (Law)

Authoritative
Source

EU Regulation 2022/2554

Entered Into
Force

January 2023

Fully
Enforceable

January 17, 2025

Enforced By

European Supervisory Authorities (ESAs) & national regulators

Applies To

EU financial entities and critical ICT third-party providers

Certification
Available

No official certification. SCF CAP can demonstrate conformity.

TL / DR — Too Long / Didn’t Read

The Digital Operational Resilience Act (DORA) is a significant leap in EU regulation that embeds operational resilience as a compliance expectation, not an optional security benefit. For financial entities and Information and Communication Technology (ICT) providers, it sets a high bar that is enforceable, with costly non-compliance ramifications. Organizations are expected to align their ICT risk management, incident reporting, resilience testing and third-party oversight practices to DORA.

DORA’s broad scope covers tens of thousands of financial entities and their ICT vendors operating in or serving the EU, applying to nearly all entities regulated under EU financial services law — including banks, insurers, payment institutions, crypto-asset service providers, financial market infrastructure, and critical ICT third-party providers.

Though enforcement under DORA had not yet materialized at its outset, the penalty framework is severe and regulators across EU member states have already signaled readiness to act aggressively — with fines up to 2% of annual worldwide turnover for financial entities and daily fines for up to six months until compliance is restored.

GRC-Focused Overview

DORA — Origins and Purpose

Before DORA, EU financial regulation around digital and ICT risk was fragmented — banks, insurers, payment services and asset managers operated under different national or sectoral rules. DORA harmonizes these requirements into a single enforceable framework for the entire European financial sector.

In September 2020, the European Commission launched the initiative for DORA as part of its Digital Finance Package. In November 2022, the Parliament and Council approved Regulation (EU) 2022/2554, which entered into force in January 2023. A two-year transition followed, with full application required from January 17, 2025. DORA’s scope includes approximately 20 categories of financial entities and ICT third-party providers.

ICT Risk Management

Entities must implement a comprehensive ICT risk management framework covering governance, policies, asset mapping, threat monitoring and controls integration with business continuity.

ICT Incident Reporting

Organizations must deploy detection, classification and timely reporting processes for ICT incidents, including categorization and workflows for notification to competent authorities.

Digital Operational Resilience Testing

Entities are required to carry out regular ICT resilience testing, including threat-led penetration tests and scenario-based continuity exercises.

ICT Third-Party Risk Management

DORA mandates robust oversight for outsourced ICT, including pre-contract due diligence, ongoing monitoring, contractual safeguards and escalation protocols, especially for critical third-party providers.

Information Sharing

While voluntary, DORA encourages threat intelligence and incident data sharing among peers and authorities to enhance collective resilience. ESAs have developed Regulatory Technical Standards (RTS) and Implementing Technical Standards (ITS) covering aspects from reporting templates to penetration testing protocols.

Enforcement

Ramifications of Non-Compliance with DORA

Though enforcement under DORA had not yet materialized, the penalty framework is severe and regulators across EU member states have already signaled readiness to act aggressively.

DORA empowers European Supervisory Authorities (ESAs) and national regulators to impose significant penalties:

Financial Entity Fines

Fines up to 2% of annual worldwide turnover or €10 million, whichever is higher. Senior individuals may face penalties up to €1 million.

Critical ICT Provider Penalties

Fines up to €5 million or 1% of average daily turnover; individuals up to €500,000. Authorities may issue daily fines for up to six months until compliance is restored.

Operational and Reputational Consequences

Regulators can also enact administrative warnings, require remediation, or suspend operational licenses under repeated or severe non-compliance. Failure to report ICT incidents in line with DORA timelines or inadequate resilience testing can trigger reputational harm and compensatory liabilities to clients or third parties.

Compliance Strategy

Common Methods to Achieve and Maintain DORA Compliance

Achieving compliance under DORA requires a cross-functional and risk-based approach:

Governance and Organizational Buy-In

Form a cross-disciplinary resilience team spanning IT, risk, compliance and business; establish executive oversight, board-level alignment and defined risk tolerances.

ICT Asset and Risk Inventory

Catalog critical systems and classify ICT assets for operational importance and third-party dependencies.

Incident Detection, Classification and Reporting

Use standardized criteria for incident severity and reporting thresholds, supported by the ESAs’ RTS/ITS.

Resilience Testing Regimen

Implement a maturity-aligned testing program: regular vulnerability scans, threat-led testing and tabletop simulations.

Third-Party Risk Controls

Index and assess suppliers; embed resilience clauses in contracts; conduct ongoing audits, especially for critical ICT providers.

Intelligence Sharing

Participate in secure forums for sharing cyber threat data and operational lessons.

Documentation and Evidence Gathering

ICT risk management plans, incident response logs, testing records, third-party assessments, governance records and framework mapping documentation all demonstrate that compliance is operational rather than asserted.

Documentation Value

Understanding The Value of Quality Cybersecurity Documentation in DORA Success

At the intersection of cyber resilience and regulation, documentation is the keystone of both preparedness and regulatory trust.

Audit Evidence

Demonstrates that risk management, incident handling, testing and third-party controls are not theoretical but operational.

Root Cause Analysis

Incident post-mortems trace failures and build institutional learning. Documentation of these analyses demonstrates to regulators that corrective actions were taken and controls were improved.

Assurance to Supervisors

Clear, versioned policies show leaders and authorities that governance is intentional and reviewed. Boilerplate policies or ad-hoc procedures increase risk. DORA demands living, role-assigned and outcomes-backed documentation — not checkbox artifacts.

Maturity Roadmap

Documentation supports benchmarking improvements over time and provides evidence that the organization’s resilience posture is continuously improving — a key expectation under DORA’s ongoing compliance obligations.

Digital Operational Resilience Act (DORA)

Digital Operational Resilience Act (DORA)

DORA — Origins and Purpose

ICT Risk Management

ICT Incident Reporting

Digital Operational Resilience Testing

ICT Third-Party Risk Management

Information Sharing

Ramifications of Non-Compliance with DORA

Financial Entity Fines

Critical ICT Provider Penalties

Operational and Reputational Consequences

Common Methods to Achieve and Maintain DORA Compliance

Governance and Organizational Buy-In

ICT Asset and Risk Inventory

Incident Detection, Classification and Reporting

Resilience Testing Regimen

Third-Party Risk Controls

Intelligence Sharing

Documentation and Evidence Gathering

Understanding The Value of Quality Cybersecurity Documentation in DORA Success

Audit Evidence

Root Cause Analysis

Assurance to Supervisors

Maturity Roadmap

See DORA Mapped in the SCF