DORA guide
DORA compliance: ICT risk, testing and third parties
DORA, the Digital Operational Resilience Act, is an EU regulation that sets one rulebook for how financial entities manage ICT risk. It has applied since 17 January 2025.
Because DORA is a regulation rather than a directive, it applies directly in every member state. Detailed requirements sit in technical standards drafted by the European Supervisory Authorities (ESAs) and adopted by the European Commission.
Published 26 October 2026. Last reviewed 6 November 2026. This guide is general information, not legal advice.
Who DORA applies to
DORA covers 20 types of financial entity, including credit institutions, payment and e-money institutions, investment firms, crypto-asset service providers, trading venues, central counterparties and central securities depositories, fund managers, insurers and reinsurers, insurance intermediaries other than micro, small and medium-sized ones, occupational pension funds, credit rating agencies and crowdfunding service providers.
It also creates an EU oversight framework for ICT third-party service providers that are critical to the financial sector, such as major cloud providers. In November 2025 the ESAs published the first list of designated critical ICT third-party providers, which they now oversee directly.
The five areas DORA covers
- ICT risk management: a documented framework, approved and owned by the management body, covering identification, protection, detection, response, recovery and learning
- ICT-related incident management: classifying incidents and reporting major ones to the competent authority on fixed deadlines
- Digital operational resilience testing: a risk-based testing programme, with threat-led penetration testing (TLPT) at least every three years for entities that supervisors identify
- ICT third-party risk: a register of information covering all ICT contracts, mandatory contract terms, concentration risk and exit strategies
- Information sharing: voluntary exchange of cyber threat intelligence between financial entities
Incident reporting deadlines
Delegated Regulation (EU) 2025/301 sets the deadlines for major ICT-related incidents: an initial notification within 4 hours of classifying the incident as major, and no later than 24 hours after becoming aware of it; an intermediate report within 72 hours of the initial notification; and a final report within one month of the latest intermediate report.
Management is responsible
The management body bears final responsibility for managing ICT risk. It sets the digital operational resilience strategy, approves the ICT risk framework, allocates budget and must keep its own ICT risk knowledge up to date.
Proportionality
DORA applies proportionately: obligations scale with an entity's size, risk profile and the nature of its services. Some small and non-interconnected entities can use a simplified ICT risk management framework.
What good DORA help looks like
Typical needs are a gap assessment against DORA and its technical standards, an ICT risk framework and policies, an incident classification and reporting process, a register of information for ICT suppliers, contract remediation, and a testing programme. Entities in scope for TLPT also need testers that meet the requirements of Delegated Regulation (EU) 2025/1190, which builds on the TIBER-EU framework.
Ask providers for financial-sector experience, familiarity with your national supervisor, and examples of registers of information or incident playbooks they have delivered.
How CISO Talents helps
At launch you can post a DORA readiness or testing request through a guided brief. Verified consultants, vCISOs and testing firms that list DORA work see it with the reason it matched, and reply in a common format.
Frequently asked questions
Is DORA the same as NIS2?
No. DORA is a regulation specific to the financial sector and applies directly. NIS2 is a cross-sector directive implemented through national laws. For financial entities in scope of both, DORA is treated as the more specific law for ICT risk management and incident reporting.
Do ICT suppliers to banks need to comply with DORA?
Financial entities must put DORA requirements into their ICT contracts, so suppliers feel its effect through contract terms, audits and exit planning. Providers designated as critical, the first of which the ESAs listed in November 2025, are overseen directly by the European Supervisory Authorities.
What is TLPT?
Threat-led penetration testing simulates the tactics of real attackers against live production systems that support critical functions. Under DORA, entities identified by their supervisor must run it at least every three years.
