Compliance · DORA
DORA
The EU Digital Operational Resilience Act: binding ICT risk and resilience requirements for financial entities and their critical ICT third parties.
Last reviewed . Regulation moves, so check the regulation tracker for the current position.
What it is
Five pillars of operational resilience.
DORA is an EU regulation that has applied since 17 January 2025. It spans ICT risk management, incident reporting, digital operational resilience testing, ICT third-party risk, and information sharing.
It applies directly to EU financial entities, and through them to the ICT providers they depend on. UK companies are not directly regulated by it, but can be drawn in through an EU group entity or by supplying ICT services to EU financial institutions.
Who needs it
Financial entities and the companies that supply them.
In-scope financial entities include banks, insurers, investment firms, payment and e-money institutions and crypto-asset service providers, plus the ICT providers they depend on, where resilience obligations now pass through contractually.
For a UK firm, the trigger is the counterparty, not the client’s address. Having private clients who live in the EU creates no DORA obligation. Supplying ICT services, such as a reporting portal or data feed, to an EU-regulated institution can put you in its third-party register and in front of its DORA supplier audit.
Related
The five pillars
What DORA asks for in practice.
- ICT risk management: a documented framework, owned by the management body, covering how ICT risk is identified, protected against, detected, responded to and recovered from
- Incident reporting: classify ICT-related incidents and report major ones to the competent authority on tight, staged deadlines
- Resilience testing: a risk-based testing programme, with threat-led penetration testing at least every three years for the entities selected for it
- ICT third-party risk: a register of every ICT third-party arrangement, due diligence, prescribed contract terms and tested exit plans
- Information sharing: voluntary arrangements to exchange cyber threat intelligence with other financial entities
Third-party risk
The register is where most firms start.
Articles 28 to 30 require a management-approved ICT third-party risk strategy, a register of every ICT third-party arrangement, risk-based due diligence before contracting, specific contractual provisions such as audit rights and exit assistance, and an assessment of concentration risk.
Built well, the register answers most supplier audit questions in one place and makes every other obligation easier. Classify each arrangement against the function it supports, the data it touches, how easily the supplier could be replaced, and the impact if it failed.
Timeline
How long DORA readiness takes.
For a mid-market regulated firm with limited supplier-management discipline, a credible readiness programme typically runs six to nine months: register-building and classification, contract review on the critical tier, and the policy framework and incident playbook in parallel.
Firms that already run procurement from a decent register, and whose important business service mapping for the FCA is current, can do meaningful readiness in around three months. The FCA operational resilience work and DORA overlap most heavily on dependency mapping, so each makes the other faster.
How we help
From gap to evidenced resilience.
- Gap assessment against each of the five pillars
- Build or strengthen the ICT risk-management framework
- Stand up the Article 28 third-party register that survives a regulator review
- Resilience testing readiness and the evidence to back it up
FAQ
Questions buyers actually ask
Does DORA apply to UK companies?
Not directly: it is EU regulation. It reaches UK companies in two ways: where an EU group entity is itself an in-scope financial entity, and, more commonly, where you supply ICT services to an EU financial entity that pushes its requirements down to you through contracts and supplier audits. Having individual clients who live in the EU does not bring you into scope.When did DORA come into force?
DORA has applied since 17 January 2025. The detailed requirements sit in Regulatory Technical Standards published by the European Supervisory Authorities, including those on ICT third-party risk management.What is the DORA register of information?
A register of all ICT third-party arrangements an in-scope entity relies on. It records who the supplier is, the function supported, how critical the arrangement is and why, the data and jurisdictions involved, sub-contractors, key contract terms and the exit plan. The full register is submitted to the competent authority each year, and planned arrangements supporting critical or important functions must be notified in advance.Do we need threat-led penetration testing under DORA?
Every in-scope entity needs a risk-based resilience testing programme. Threat-led penetration testing (TLPT), at least every three years, applies to the financial entities that competent authorities select based on their size and systemic importance, not to everyone.How does DORA relate to the FCA operational resilience rules?
They are legally separate but overlap. The FCA regime is about your important business services, impact tolerances and scenario testing; DORA’s Article 28 is about managing ICT third-party risk. Both need the same dependency mapping, so doing one well makes the other faster.How long does DORA readiness take?
Typically six to nine months for a mid-market firm starting with limited supplier-management discipline, around three months where a good register and current dependency mapping already exist, and up to twelve if starting from very little.
Working out what DORA means for you?
Bring your situation; we’ll tell you honestly where you stand against the five pillars.
Book a call Also available in AWS Marketplace