DORA (Regulation (EU) 2022/2554)
What it is
An EU regulation on digital operational resilience for the financial sector, applying directly in every member state since 17 January 2025. Its pillars are ICT risk management (Articles 5 to 16), ICT-related incident management and reporting (17 to 23), digital operational resilience testing (24 to 27), ICT third-party risk (28 to 44) and information sharing (45). Regulatory technical standards, such as Delegated Regulation (EU) 2024/1774 on the ICT risk management framework, add the detail.
Who needs it
About twenty types of EU financial entity, including credit institutions, payment and e-money institutions, investment firms, crypto-asset service providers, insurers and reinsurers. The European Supervisory Authorities also oversee critical ICT third-party service providers directly. For financial entities, DORA's rules take precedence over the equivalent NIS2 measures.
How it's assessed
There is no certification. National competent authorities, and the ECB for significant banks, supervise compliance. Major ICT-related incidents are reported in stages (an initial notification, intermediate reports and a final report) on deadlines set in the technical standards. Entities selected by their authority must run threat-led penetration testing (TLPT) at least every three years.
Counts: the articles that bind financial entities (5–14, 16–19, 24–30, 45), mapped at paragraph level.
DORA here means the articles that bind financial entities, mapped editorially at paragraph level. The technical standards that add detail, such as Delegated Regulation (EU) 2024/1774, are not mapped, so technical topics they cover show no link.
Requirements
| ID | Requirement | Topics | Mapped in |
|---|---|---|---|
| Chapter II: ICT risk management · 11 | |||
| Art.5 | Governance and organisation | Risk Management, Governance Policy, Roles & Responsibilities, Compliance, Awareness & Training | 10 of 13 |
| Art.6 | ICT risk management framework | Risk Management, Physical Security, Roles & Responsibilities, Governance Policy, Compliance | 10 of 13 |
| Art.7 | ICT systems, protocols and tools | — | none |
| Art.8 | Identification | Asset Management, Business Environment, Data Classification, Risk Assessment, Vulnerability Mgmt, Threat Intelligence | 13 of 13 |
| Art.9 | Protection and prevention | Cont. Monitoring, Data Protection, Encryption, Governance Policy, Firewall / Net Seg, Access Control, Privileged Access, Physical Security, Multi-Factor Auth, Patch Management | 10 of 13 |
| Art.10 | Detection | Intrusion Detection, Anomaly Detection, SIEM / SOC, Cont. Monitoring, Logging & Audit, Insider Threat | 10 of 13 |
| Art.11 | Response and recovery | Business Continuity, Incident Response, Mitigation, Comms & Restore, Recovery Planning, Business Environment, Disaster Recovery | 8 of 13 |
| Art.12 | Backup policies and procedures, restoration and recovery procedures and methods | Backup & Recovery, Disaster Recovery, Recovery Planning | 11 of 13 |
| Art.13 | Learning and evolving | Threat Intelligence, Forensics, Lessons Learned, Awareness & Training | 6 of 13 |
| Art.14 | Communication | Communication | 8 of 13 |
| Art.16 | Simplified ICT risk management framework | Risk Management | 10 of 13 |
| Chapter III: ICT-related incidents · 3 | |||
| Art.17 | ICT-related incident management process | Incident Response, Forensics, Communication, Mitigation | 12 of 13 |
| Art.18 | Classification of ICT-related incidents and cyber threats | Incident Response, Reporting | 12 of 13 |
| Art.19 | Reporting of major ICT-related incidents and voluntary notification of significant cyber threats | Reporting | 12 of 13 |
| Chapter IV: Resilience testing · 4 | |||
| Art.24 | General requirements for the performance of digital operational resilience testing | Risk Management | 10 of 13 |
| Art.25 | Testing of ICT tools and systems | Vulnerability Mgmt | 13 of 13 |
| Art.26 | Advanced testing of ICT tools, systems and processes based on TLPT | Vulnerability Mgmt | 13 of 13 |
| Art.27 | Requirements for testers for the carrying out of TLPT | Vulnerability Mgmt | 13 of 13 |
| Chapter V: ICT third-party risk · 3 | |||
| Art.28 | General principles | Supply Chain Risk, Vendor Risk Mgmt, Cloud Security | 9 of 13 |
| Art.29 | Preliminary assessment of ICT concentration risk at entity level | Supply Chain Risk | 9 of 13 |
| Art.30 | Key contractual provisions | Cloud Security, Vendor Risk Mgmt | 12 of 13 |
| Chapter VI: Information sharing · 1 | |||
| Art.45 | Information-sharing arrangements on cyber threat information and intelligence | Threat Intelligence | 6 of 13 |
Topic coverage
Topics with mapped DORA requirements (39):
No mapping in our data No DORA requirement (11):