Digital Operational Resilience Act
(DORA)
The EU regulation mandating digital operational resilience for financial entities — requiring robust ICT risk management, incident reporting, resilience testing, and strict third-party provider controls across the EU financial sector.
5
Pillars
Risk · Incidents · Testing · 3P · Sharing
2025
Applicable Since
January 17, 2025
20+
Sectors in Scope
Financial entity types
ESAs
CTPP Oversight
EBA · ESMA · EIOPA
What is DORA?
The Digital Operational Resilience Act (Regulation (EU) 2022/2554) is binding EU legislation that entered application on 17 January 2025. It establishes uniform requirements for the security of network and information systems of financial entities operating in the EU — and critically, extends obligations to ICT third-party providers who supply critical services to those entities.
DORA's third-party risk pillar (Articles 28–44) places direct obligations on cloud providers classified as Critical Third-Party Providers (CTPPs) by the European Supervisory Authorities (ESAs). CTPPs become subject to direct oversight visits, information requests, and binding recommendations — making DORA the first EU regulation to directly regulate cloud providers within the financial sector supply chain.
For sovereign cloud assessments, DORA's third-party risk requirements intersect with data residency, legal jurisdiction, and operational sovereignty — particularly the mandatory contractual provisions for exit plans, audit rights, and sub-outsourcing controls that financial entities must obtain from their CSPs.
Entities in Scope
DORA's 5 Pillars
ICT Risk Management
DORA Articles 5–16Governance framework for identifying, classifying, and managing ICT risks. Boards must own ICT risk; policies must cover asset management, anomaly detection, business continuity, and backup strategy.
- Board-level ICT risk ownership and annual review
- Asset inventory with criticality classification
- Business continuity plans and ICT-specific disaster recovery
- Backup and restoration procedures with tested RPO/RTO
ICT Incident Management
DORA Articles 17–23Mandatory classification, management, and reporting of ICT-related incidents. Major incidents must be reported to competent authorities within defined timelines.
- ICT incident classification and severity framework
- Initial notification within 4 hours of major incident detection
- Intermediate report within 72 hours; final report within 1 month
- Root cause analysis and lessons-learned process
Digital Operational Resilience Testing
DORA Articles 24–27Annual resilience testing and, for significant entities, Threat-Led Penetration Testing (TLPT) every 3 years using the TIBER-EU framework.
- Annual vulnerability assessments and penetration testing
- TLPT every 3 years for significant financial institutions
- Testing scope covers critical ICT systems and third-party providers
- Findings remediated within agreed timelines; retesting required
ICT Third-Party Risk
DORA Articles 28–44Pre-contractual risk assessment, mandatory contractual provisions, and concentration risk monitoring for all critical ICT third-party providers (CTPPs). Cloud providers are directly in scope.
- Pre-contract due diligence with documented risk assessment
- Mandatory contractual provisions: audit rights, exit plans, SLAs, sub-outsourcing controls
- ICT concentration risk monitoring across provider and geography
- Oversight framework for Critical Third-Party Providers (CTPPs)
Information Sharing
DORA Article 45Voluntary intelligence sharing arrangements between financial entities on cyber threats, vulnerabilities, and tactics, techniques, and procedures (TTPs).
- Participation in trusted threat intelligence sharing arrangements
- Anonymised disclosure of incident patterns and TTPs
- Coordination with sector CERTs and national authorities
Critical Third-Party Provider (CTPP) Designation
ESAs designate a provider as a CTPP when one or more of the following criteria are met:
- !The ICT services provided are systemically important to EU financial markets
- !Substitutability is low — no readily available alternative provider exists
- !Material dependency exists across multiple financial entities simultaneously
- !The provider operates at scale across multiple EU member states
DORA Timeline
DORA Regulation (EU) 2022/2554 enters into force
RTS/ITS published by ESAs (EBA, ESMA, EIOPA) covering incident reporting, TLPT, third-party risk
DORA application date — all in-scope financial entities must be fully compliant
ESAs publish first register of Critical Third-Party Providers (CTPPs)
Ongoing CTPP oversight by ESAs; first TLPT cycle begins for significant institutions
Disclaimer
Assessments produced by this platform are self-attested evaluations and do not constitute formal DORA compliance certification. Financial entities subject to DORA must ensure their ICT risk management framework, incident reporting procedures, and third-party contracts meet the requirements of Regulation (EU) 2022/2554 and the associated Regulatory Technical Standards (RTS) published by the ESAs.
Ready to assess your DORA posture?
Run a full sovereignty assessment covering DORA third-party risk requirements.