5 DORA Requirements for Digital Operational Resilience

What Are the Core DORA Requirements?

The Digital Operational Resilience Act, formally Regulation (EU) 2022/2554, standardizes digital security rules across the financial sector in the European Union. Having entered into application on January 17, 2025, DORA requirements apply directly to 20 different categories of financial entities, ranging from credit institutions and investment firms to insurance undertakings. Crucially, the rules also reach critical Information and Communication Technology (ICT) third-party service providers that supply cloud platforms, software, and data services to those entities.

Financial systems depend heavily on interconnected software vendors and infrastructure providers. When an outage or cyber incident strikes an ICT supplier, the disruption can quickly cascade across multiple financial institutions, sovereign borders, and the broader economy. To reduce this systemic exposure, DORA unifies digital operational resilience rules into five core pillars. You can evaluate your organizational readiness using our GRC compliance readiness assessment to identify gaps before supervisory examinations begin.

Rather than treating information security as an isolated technical problem, the framework places explicit accountability on the management body of each financial entity. Leadership must approve, oversee, and periodically review the organization's ICT risk management framework, allocate adequate cybersecurity resources, and verify that operational controls match exposure across all critical business functions.

1. ICT Risk Management Framework

The first pillar establishes baseline principles for governing, identifying, protecting, detecting, and recovering from ICT risks. Regulated financial entities must document and maintain an internal ICT risk management framework that reflects their business model, risk profile, and systemic role. This framework requires a complete inventory of information assets, business processes, and external system dependencies, which teams should update regularly and following any major architecture change.

Under this requirement, organizations must implement technical safeguards, including strict network access controls, continuous vulnerability management, and end-to-end data encryption for data in transit and at rest. Security teams must document formal procedures for patching vulnerabilities and logging network activity. You can learn how to structure these baseline controls in our guide on how to build a security policy framework.

Business continuity and disaster recovery form a mandatory component of this pillar. Entities must develop ICT business continuity policies that specify maximum acceptable downtime (recovery time objectives) and acceptable data loss (recovery point objectives) for critical services. These plans must undergo periodic operational testing to prove that secondary systems restore normal business functions without data corruption or unauthorized administrative modifications.

2. ICT-Related Incident Management and Reporting

The second pillar requires financial institutions to define procedures for identifying, tracking, logging, and categorizing all ICT incidents. Security teams must monitor alerts continuously and evaluate operational events against predefined impact criteria, including the number of affected clients, the geographic reach of the disruption, data loss volumes, and the criticality of the services affected. You can structure this classification process by using our cyber risk register to map incident categories against operational thresholds.

When an event crosses regulatory thresholds and qualifies as a major ICT-related incident, the entity must submit standardized reports to its competent authority. DORA requires prompt initial notification, followed by intermediate updates and a final report as specified in the Regulatory Technical Standards (RTS) and Implementing Technical Standards (ITS) on incident reporting, covering root cause analysis, operational impacts, and remedial measures taken to prevent recurrence.

Management must retain logs and evidentiary records associated with security incidents for regulatory examination. Having clear detection playbooks and predefined reporting templates ensures security operations teams can alert competent authorities without delaying technical containment and eradication activities during an active compromise.

3. Digital Operational Resilience Testing

DORA mandates that financial organizations validate their defenses through digital operational resilience testing rather than relying solely on theoretical risk profiles. Financial entities must perform regular digital operational resilience testing in line with the relevant RTS, typically at least once per year for standard assessments. Assessments can include vulnerability assessments, open-source software evaluations, network reviews, and gap analyses against recognized operational standards.

Where applicable under regulatory criteria, DORA mandates advanced Threat-Led Penetration Testing (TLPT) in accordance with the RTS on TLPT. Competent authorities identify entities required to conduct TLPT based on their systemic impact, size, and operational profile. These live testing exercises simulate real-world cyber adversary tactics, techniques, and procedures against production systems supporting critical or important business functions.

Third-party ICT service providers that support critical business operations must cooperate during TLPT exercises. If an external vendor hosts a critical ledger or core banking workload, that provider must participate in the financial entity's penetration testing scope, providing operational access or running pooled testing exercises to prove the joint infrastructure withstands sophisticated attacks.

4. ICT Third-Party Risk Management

Outsourcing IT operations does not transfer regulatory responsibility. The fourth pillar requires financial entities to manage supplier risk across the full procurement lifecycle, from initial due diligence to contract termination. Entities must maintain a comprehensive Register of Information that documents every contractual arrangement with third-party providers, distinguishing between standard services and those supporting critical or important business functions.

Contracts with ICT vendors must incorporate specific clauses mandated by DORA. These provisions include unambiguous service level descriptions, data location guarantees, mandatory participation in resilience testing, clear incident notification timelines, and unrestricted audit and inspection rights for both the financial entity and supervisory authorities. Our guide on how to run a vendor security assessment details how to vet external suppliers against these criteria before finalizing agreements.

According to EIOPA Digital Operational Resilience Act guidance, DORA establishes an EU-wide oversight framework for critical ICT third-party providers (CTPPs) to address potential systemic and concentration risks arising from the financial sector's reliance on a limited number of providers. Once designated, these vendors face direct supervision, information requests, and on-site inspections conducted by joint examination teams.

5. Information and Intelligence Sharing

The fifth pillar permits and encourages financial institutions to establish voluntary arrangements for exchanging cyber threat intelligence and defensive indicators. By sharing actionable indicators of compromise (IOCs), attacker tactics, and vulnerability observations, entities can identify systemic campaigns early and implement defensive countermeasures before attacks spread across the financial ecosystem.

Information sharing arrangements must take place within trusted communities of financial entities and comply with European data protection regulations. The shared details must aim to enhance digital operational resilience, warn peers of emerging exploitations, or validate defensive configurations without revealing proprietary trade secrets or sensitive client personal data.

Agreements governing these information-sharing networks must clearly define membership criteria, handling caveats, and cryptographic protections used to secure shared feeds. Regulators encourage financial firms to join established industry information sharing and analysis centers to standardize reporting schemas and build regional situational awareness.

Implementation Checklist for DORA Compliance

Preparing your organization to meet DORA requirements requires structured coordination across engineering, procurement, legal, and executive teams. Testing frequency and reporting deadlines should be verified against the specific Level 2 Regulatory Technical Standards (RTS) and national competent authority guidance to ensure strict alignment with current regulatory requirements.

Begin by auditing contracts with your technology suppliers to verify whether audit clauses and incident notification windows comply with regulatory expectations. Follow this by updating your business continuity plans and scheduling resilience testing to ensure all critical services meet their specified recovery targets.

PILLAR 1: ICT Risk Management
[ ] Map all business functions to supporting ICT assets and software dependencies.
[ ] Document maximum acceptable downtime and data loss metrics for critical operations.
[ ] Conduct periodic reviews of ICT risk management policies with executive sign-off as defined in the RTS.

PILLAR 2: Incident Management & Reporting
[ ] Define classification criteria for major ICT incidents (clients affected, downtime, data loss).
[ ] Establish notification runbooks to submit initial, intermediate, and final reports to competent authorities.
[ ] Centralize audit logs for security monitoring and post-incident forensic audits.

PILLAR 3: Digital Operational Resilience Testing
[ ] Perform standard vulnerability assessments and testing in line with applicable RTS intervals.
[ ] Identify whether your institution meets criteria for Threat-Led Penetration Testing (TLPT).
[ ] Establish remediation trackers with assigned owners for all testing findings.

PILLAR 4: ICT Third-Party Risk Management
[ ] Populate and validate the complete Register of Information for all ICT service contracts.
[ ] Update vendor agreements to include mandated audit, termination, and data retrieval rights.
[ ] Evaluate concentration risk for critical services dependent on single external providers.

PILLAR 5: Information Sharing
[ ] Review guidelines for sharing threat intelligence and indicators of compromise (IOCs).
[ ] Establish legal safeguards ensuring compliance with EU privacy and confidentiality rules.