What is DORA?
The Digital Operational Resilience Act — the EU regulation that makes banks, insurers and other financial entities prove they can withstand, respond to and recover from ICT disruptions.
Definition
The Digital Operational Resilience Act (DORA) is an EU regulation — Regulation (EU) 2022/2554 — that creates a single, comprehensive framework for managing information and communication technology (ICT) risk across the financial sector. It entered into force in January 2023 and applies from 17 January 2025.
Where earlier rules focused mainly on the financial capital firms hold against operational risk, DORA focuses on their ability to keep running — to withstand, respond to and recover from ICT-related disruptions and cyber threats. It harmonises requirements that were previously fragmented across member states and sectors, giving supervisors a consistent basis to judge how resilient a financial entity, and its technology supply chain, really is.
The five pillars of DORA
ICT risk management
A documented governance framework to identify, protect, detect, respond to and recover from ICT risks — owned by the management body.
ICT incident reporting
Classify and report major ICT-related incidents to regulators within defined timelines, using harmonised templates.
Digital operational resilience testing
Regular testing of ICT systems, including threat-led penetration testing (TLPT) for significant entities.
ICT third-party risk management
Monitor and manage risk from ICT providers (including cloud), with mandatory contractual safeguards and a register of information.
Information sharing
Voluntary exchange of cyber-threat intelligence and information among trusted financial entities.
Who needs to comply?
DORA applies to a broad range of financial entities — credit institutions, payment and e-money institutions, investment firms, crypto-asset service providers, insurers and reinsurers, fund managers and more — as well as the critical ICT third-party service providers (such as major cloud providers) that serve them. If you operate in EU financial services, or supply technology to firms that do, DORA very likely applies.
How ISpectra helps you become DORA-ready
We run the full DORA program: ICT risk assessment and gap analysis, resilience testing (including TLPT coordination), incident-response and reporting playbooks, and third-party contract remediation — mapped to controls you may already hold for ISO 27001 or SOC 2 so you reuse evidence rather than rebuild it.
Talk to a DORA advisor