A cloud outage at one provider can stop payments at hundreds of banks at once. The EU’s Digital Operational Resilience Act (DORA) exists because regulators decided that this kind of shared dependency is a financial-stability risk, not just an IT problem.
DORA has applied since 17 January 2025. By now most financial entities have their first ICT incident reports and their first register of information behind them, and supervisors have moved from “are you ready?” to “show us it works”. This guide explains what the regulation requires, who it covers, and where to focus if your programme still has gaps.
What DORA is
DORA is Regulation (EU) 2022/2554 on digital operational resilience for the financial sector. It was adopted on 14 December 2022 and, under Article 64, applies from 17 January 2025. Because it is a regulation, it applies directly in every Member State. There is no national transposition of the core rules, although countries pass laws to name competent authorities and set penalties. Italy did this with Legislative Decree no. 23 of 10 March 2025, which designates the Banca d’Italia, Consob, IVASS and COVIP as DORA competent authorities for the entities they supervise.
DORA sits alongside a companion directive, (EU) 2022/2556, which amends existing financial-sector directives so that they line up with the regulation.
Who is in scope
Financial entities
Article 2(1) lists the entities covered. In practice that includes almost the whole regulated EU financial sector:
- credit institutions, payment institutions, account information service providers and electronic money institutions
- investment firms, trading venues, central counterparties, central securities depositories, trade repositories and data reporting service providers
- crypto-asset service providers and issuers of asset-referenced tokens
- AIFMs and UCITS management companies
- insurance and reinsurance undertakings, and insurance, reinsurance and ancillary insurance intermediaries
- institutions for occupational retirement provision
- credit rating agencies, administrators of critical benchmarks, crowdfunding service providers and securitisation repositories
Article 2(3) carves out some small players, such as insurance intermediaries that are microenterprises or SMEs, and occupational pension schemes with 15 or fewer members in total.
Proportionality and the simplified framework
Article 4 says the rules apply in line with each entity’s size and overall risk profile. Article 16 goes further: small and non-interconnected investment firms, exempted payment and e-money institutions, small occupational retirement institutions and certain exempted credit institutions use a simplified ICT risk management framework instead of the full Chapter II requirements.
ICT third-party service providers
ICT third-party service providers also appear in Article 2(1). Most of them are not regulated directly. Instead, DORA reaches them through the contracts financial entities must sign with them. The exception is critical ICT third-party service providers (CTPPs). Under Article 31, the three European Supervisory Authorities (EBA, EIOPA and ESMA), acting through their Joint Committee, designate providers as critical. They weigh systemic impact, how important the financial entities that rely on the provider are, how far critical functions depend on it, and how easily it could be replaced.
Each CTPP gets a Lead Overseer, the ESA responsible for the financial entities that hold the largest share of total assets among the provider’s customers. The ESAs published the first list of designated CTPPs on 18 November 2025. Lead Overseers can impose periodic penalty payments of up to 1% of the provider’s average daily worldwide turnover, charged daily for up to six months (Article 35).
The five pillars of DORA
1. ICT risk management and governance (Articles 5–16)
Article 5 puts the management body in charge. It bears “ultimate responsibility” for managing ICT risk, approves the digital operational resilience strategy, approves the business continuity and response and recovery plans, and allocates the budget. Article 5(4) requires board members to keep their ICT risk knowledge current, including through regular, specific training.
Entities need a documented ICT risk management framework. It must be reviewed at least once a year (periodically for microenterprises), after major incidents, and after supervisory findings (Article 6(5)). The framework covers asset identification, protection and prevention, detection, response and recovery, backups, learning and communication. Article 13(6) makes ICT security awareness programmes and digital operational resilience training compulsory for all employees and senior management.
2. ICT-related incident management and reporting (Articles 17–23)
You need a process to detect, log, classify and respond to ICT-related incidents. A “major” incident is one with a high adverse impact on systems supporting critical or important functions. You classify incidents using the criteria in Article 18 (clients affected, duration, geographic spread, data losses, criticality of services and economic impact), as detailed in Delegated Regulation (EU) 2024/1772.
Major incidents go to your competent authority in three stages. That authority then forwards them to the ESAs, the ECB where relevant, and the national NIS2 CSIRTs. You may also notify significant cyber threats voluntarily (Article 19(2)). If a major incident affects clients’ financial interests, you must tell them without undue delay (Article 19(3)).
3. Digital operational resilience testing (Articles 24–27)
All entities outside the simplified regime must test, at least yearly, all ICT systems and applications supporting critical or important functions (Article 24(6)). Tests range from vulnerability scans and network security assessments to scenario-based and end-to-end testing.
Entities identified by their competent authority must also run threat-led penetration testing (TLPT) at least every three years (Article 26). TLPT simulates real attackers against live production systems and covers several or all critical or important functions. Delegated Regulation (EU) 2025/1190 sets out the detailed methodology, which follows the TIBER-EU framework.
4. ICT third-party risk management (Articles 28–44)
This pillar usually takes the most work. Key duties:
- Register of information (Article 28(3)): a register of every contractual arrangement for ICT services, kept at entity, sub-consolidated and consolidated level. It is reported to the competent authority at least yearly, using the templates in Implementing Regulation (EU) 2024/2956. National deadlines vary. For 2026 the Banca d’Italia set 15 March, De Nederlandsche Bank 20 March and the CSSF in Luxembourg 31 March.
- Pre-contract assessment and notification of planned arrangements that support critical or important functions.
- Contract clauses (Article 30): service descriptions, data locations, security, service levels, incident assistance, audit and access rights, termination rights and, for critical or important functions, exit strategies with a transition period and participation in TLPT.
- Exit strategies (Article 28(8)): documented, tested and reviewed plans to leave a provider without disrupting the business. Cloud concentration is the usual pain point; our guide to securing cloud infrastructure covers the technical side.
5. Information sharing (Article 45)
Financial entities may share cyber threat information and intelligence within trusted communities, provided they protect confidentiality and personal data and respect competition law. Participation is voluntary, but you must notify your competent authority when you join or leave an arrangement.
Major incident reporting timelines
Article 19 sets out the three reports. Delegated Regulation (EU) 2025/301 sets the deadlines:
| Report | Deadline | What it covers |
|---|---|---|
| Initial notification | Within 4 hours of classifying the incident as major, and no later than 24 hours after becoming aware of it | Basic facts, first impact view |
| Intermediate report | Within 72 hours of the initial notification, then updated without undue delay when the status changes significantly, and once regular activities are recovered | Detailed impact, response actions |
| Final report | Within 1 month of the latest intermediate report | Root cause, actual impact figures, lessons learned |
If the incident is only classified as major after the 24-hour mark, the four-hour clock runs from classification. Most entities may file by noon of the next working day when a deadline falls on a weekend or bank holiday. That relief does not apply to initial notifications and intermediate reports from credit institutions, central counterparties, trading venue operators and entities designated as essential or important under NIS2. The report forms are in Implementing Regulation (EU) 2025/302. In Italy, entities supervised by the Banca d’Italia report through its INFOSTAT platform.
Personal data involved? GDPR breach notification runs in parallel. See our guide to the GDPR 72-hour rule.
Key technical standards to know
| Instrument | Topic |
|---|---|
| Delegated Regulation (EU) 2024/1774 | ICT risk management tools, methods and the simplified framework |
| Delegated Regulation (EU) 2024/1772 | Classification of ICT-related incidents and cyber threats |
| Delegated Regulation (EU) 2025/301 | Content and time limits for major incident reports |
| Implementing Regulation (EU) 2025/302 | Standard forms and templates for incident reporting |
| Delegated Regulation (EU) 2024/1773 | Policy on ICT services supporting critical or important functions |
| Implementing Regulation (EU) 2024/2956 | Templates for the register of information |
| Delegated Regulation (EU) 2025/532 | Subcontracting of ICT services supporting critical or important functions |
| Delegated Regulation (EU) 2025/1190 | Threat-led penetration testing |
Penalties
DORA does not set EU-wide fine amounts for financial entities. Article 50 requires Member States to provide administrative penalties and remedial measures that are “effective, proportionate and dissuasive”. These include orders to stop conduct, financial penalties and public notices. Check your national implementing law for the actual amounts.
Practical first steps (or a 2026 health check)
- Confirm your scope and regime. Check which Article 2 category you fall into, whether Article 16’s simplified framework applies, and who your competent authority is.
- Map critical or important functions. Almost every DORA obligation hangs off this list: testing, contracts, exit plans, TLPT scope.
- Run a gap analysis against Chapter II and Delegated Regulation 2024/1774. If you already run ISO/IEC 27001, start there. See our ISO 27001:2022 implementation roadmap.
- Fix the register of information. Validation rules are strict and supervisors reject incomplete files. Treat the register as a living inventory, not a once-a-year spreadsheet.
- Repaper key contracts against Article 30 and the subcontracting standard, starting with providers that support critical or important functions.
- Rehearse incident reporting. Make sure your team can classify an incident and file within four hours. A tabletop exercise is the quickest way to find out. See our tabletop exercise guide, and align the process with your wider incident response plan.
- Train the board and staff. Articles 5(4) and 13(6) make training a legal requirement, not a nice-to-have. A structured programme helps; see building a security awareness training program.
- Test and document. Build an annual testing plan, keep evidence of results and fixes, and prepare for TLPT if your authority is likely to select you.
If you are also subject to NIS2 or handle large volumes of personal data, design one control set for all three regimes rather than three parallel programmes. Our NIS2 vs DORA vs GDPR comparison shows how.
This is general guidance, not legal advice.
AceFortis runs practical DORA training for ICT, risk and compliance teams and for management bodies, from incident classification drills to board-level ICT risk briefings. Get in touch to plan a session.
FAQ
Does DORA apply to non-EU companies?
DORA applies to EU financial entities. Non-EU ICT providers are affected through their contracts with those entities. A provider in a third country that is designated as critical must set up an EU subsidiary within 12 months of designation.
Does DORA replace NIS2 for banks and other financial entities?
For the ICT risk management, incident reporting and supervision topics it covers, yes. NIS2 treats DORA as a sector-specific act, and DORA describes itself as lex specialis to NIS2. GDPR still applies in full.
How often must we run TLPT?
At least every three years, if your competent authority has identified you as required to perform it. The authority can lengthen or shorten that cycle based on your risk profile.
Is the register of information just a list of suppliers?
No. It records every contractual arrangement for ICT services, which functions it supports, and details of the subcontracting chain, using mandatory EU templates.
