What DORA is and when it applies
Regulation (EU) 2022/2554 on digital operational resilience for the financial sector, or DORA for short, sets uniform requirements for the security of network and information systems in the EU financial sector. It has applied since 17 January 2025. Because it is a regulation, it applies directly, without transposition into national law. The details are set by regulatory and implementing technical standards (RTS and ITS) prepared by the European Supervisory Authorities EBA, EIOPA and ESMA.
The aim of the Regulation is that a financial entity can withstand, respond to and recover from ICT disruption, whether it is caused by a cyber attack, a system failure or a provider outage. Responsibility for this lies with the management body, not only the IT department.
You can quickly check whether and how DORA applies to you with the tool on this page. Below we summarise the key requirements.
Who it applies to
Article 2 of the Regulation lists more than twenty types of financial entity. Among them are credit institutions, payment institutions and electronic money institutions, investment firms, management companies and managers of alternative investment funds, insurance and reinsurance undertakings, insurance intermediaries, institutions for occupational retirement provision, crypto-asset service providers, financial market infrastructure (trading venues, central securities depositories, central counterparties) and credit rating agencies. Exemptions apply to some smaller entities, for example smaller insurance intermediaries.
Obligations are proportionate to the size, nature and risk profile of the entity (Article 4). Some smaller entities, for example small and non-interconnected investment firms and exempted payment and electronic money institutions, use the simplified framework in Article 16 instead of Articles 5 to 15. Reliefs also apply to microenterprises.
Third-party ICT service providers play a special role: cloud, data centres, managed IT and security services, software. They are not financial entities, but DORA reaches them through their contracts with customers. Providers that are critical for the financial system are designated as critical (CTPPs) by the European Supervisory Authorities and overseen directly.
Which authority supervises you depends on the type of entity and the member state: the national competent authorities, which are usually the central bank or the banking, securities or insurance supervisor.
The five pillars of DORA
The requirements of the Regulation are usually summarised in five pillars. The assessment in the tool is based on the same pillars.
| Pillar | Articles | Key requirements |
|---|---|---|
| ICT risk management | 5 to 16 | a framework approved and overseen by the management body; inventory of assets and dependencies; protection, detection, response and recovery; ICT business continuity and backup policy |
| ICT incidents | 17 to 23 | incident management process; classification under uniform criteria; reporting of major incidents to the competent authority; notifying customers |
| Resilience testing | 24 to 27 | a risk-based testing programme; at least annual tests of systems supporting critical or important functions; TLPT at least every three years for entities designated by the authority |
| ICT third-party risk | 28 to 30 | strategy and policy for third-party risk; register of information; concentration risk assessment; mandatory contractual provisions; exit strategies |
| Information sharing | 45 | voluntary sharing of cyber threat information between financial entities; notifying the competent authority of participation |
In risk management it is essential that recovery plans are also documented and tested. RTO and RPO targets must follow from the criticality of business functions, not from the capacity of existing equipment. How to set and calculate them is shown in the guide Backup: RPO and RTO.
Reporting major incidents
A financial entity must log and classify all ICT-related incidents under the criteria in Delegated Regulation (EU) 2024/1772, for example by the number of clients affected, duration, geographical spread, data losses, criticality of services and economic impact. When an incident reaches the threshold for a major incident, the deadlines for reporting to the competent authority start to run. The deadlines are set by Delegated Regulation (EU) 2025/301.
| Report | Deadline | Content in brief |
|---|---|---|
| Initial notification | within 4 hours of classifying the incident as major, but no later than 24 hours from the moment the entity became aware of it | basic details of the incident and a first assessment of impact |
| Intermediate report | within 72 hours of the initial notification; updates on significant changes | more detailed description, causes, impact and measures taken |
| Final report | no later than one month after the last intermediate report | root cause analysis, actual impact and permanent measures |
Special rules apply to some entities when a deadline falls on a weekend or public holiday. Check the exact conditions in the Regulation and with your supervisor. Because the deadlines are measured in hours, reporting is feasible only with 24-hour detection, roles defined in advance and templates ready. An entity can also notify the competent authority of significant cyber threats voluntarily.
ICT providers, the register of information and exit strategies
In practice the third-party pillar often requires the most work. A financial entity remains fully responsible for compliance even when it outsources ICT services to an external provider.
- Register of information. An inventory of all contractual arrangements for ICT services, with the required data on providers, services, locations and subcontractors. Its format is set by Implementing Regulation (EU) 2024/2956, and supervisors collect the register regularly.
- Contractual provisions. Article 30 sets the minimum content of contracts: description of services, data processing locations, service levels, assistance with incidents, cooperation with authorities, termination rights. For services that support critical or important functions, extended requirements apply, including access and audit rights, cooperation in TLPT and a transition period on exit.
- Exit strategies. For services that support critical or important functions, the entity must have an exit strategy and a tested plan for moving to another provider or back in-house.
- Concentration risk. The entity must assess whether it is too dependent on a single provider or on hard-to-replace services.
For ICT providers this means new customer expectations: a standard DORA addendum to contracts, data for the register, an agreed incident notification procedure, evidence of testing and business continuity, and a clearly defined exit.
DORA and NIS2: what applies to whom
The NIS2 Directive is transposed into national law by each member state and covers, among others, banking and financial market infrastructure. For financial entities DORA is a special regime (lex specialis), so they meet the requirements on ICT risk management and incident reporting under DORA. Both frameworks can apply to an ICT provider at the same time.
| Area | DORA | NIS2 and national transposition |
|---|---|---|
| Legal form | regulation, directly applicable | directive, transposed by national law |
| Who is covered | financial entities; critical ICT providers under EU oversight | medium and large entities in 18 sectors, and some regardless of size |
| Supervision | the national competent authority for the type of financial entity | the national NIS2 authority designated by each member state |
| Incident reporting | 4 hours from classification (24 hours at most), 72 hours, 1 month | 24 hours, 72 hours, 1 month |
| Testing | testing programme, TLPT for certain entities | assessing the effectiveness of measures |
| Supply chain | register of information, mandatory contractual provisions, exit strategies | supply chain security as one of the measures |
To see how you are classified under NIS2, read the guide NIS2 Directive: is your organisation in scope?.
How to start: from assessment to demonstrable compliance
- Scope and proportionality. Use the tool above to establish which regime applies to you, and confirm it with your legal team or supervisor.
- Critical functions. Identify critical or important functions and the systems, data and providers they depend on.
- Gap analysis. For each pillar, compare the current state with the requirements of the Regulation and the technical standards, and gather evidence.
- Providers and register. Complete the register of information, review contracts against Article 30 and prepare exit strategies.
- Test in practice. Run an incident reporting exercise, a restore test and, where required, preparation for TLPT.
Humanfrog helps financial entities with the inventory of ICT services for the register of information, preparing exit strategies and resilience testing, including restore tests from Veeam backups in TIER III data centres. With managed security monitoring we support early detection of incidents. As an ICT service provider we are ready to provide financial customers with the data and contractual provisions that DORA requires. To check your starting point, talk to us.
