What is DORA? Definition, duties and deadlines
The Digital Operational Resilience Act, or DORA, has applied since 17 January 2025. The EU regulation requires financial entities within its scope to manage their digital risks and report major ICT-related incidents. It also sets requirements for testing and the management of ICT service providers. The specific obligations depend in part on the type and size of the entity.
Key takeaways
- DORA has applied since 17 January 2025. The EU regulation is directly applicable.
- Its scope is broad. It covers banks, insurers and other regulated financial entities, among others. Exemptions must be assessed on a case-by-case basis.
- The obligations extend beyond contracts. They also cover risk management, incident reporting and resilience testing.
What DORA regulates and who is affected
DORA is Regulation (EU) 2022/2554 on digital operational resilience for the financial sector. It establishes requirements for managing risks arising from information and communication technology, or ICT. As a regulation, it applies directly in EU Member States.
Entities covered include credit institutions, insurance and reinsurance undertakings, investment firms, payment institutions, electronic money institutions, certain crypto-asset service providers and fund managers. The regulation contains exemptions and provides for simplified requirements for certain entities. Entities should therefore assess their status against Article 2 and the relevant individual provisions.
What obligations DORA covers
The management body is responsible for ICT risk management. This includes a digital operational resilience strategy and documented procedures to protect systems and restore them after disruptions. The requirements must be applied proportionately, taking into account factors such as the entity’s size, risk profile and complexity.
Financial entities must record and classify ICT-related incidents. Major incidents must be reported to the competent authority. DORA also requires a digital operational resilience testing programme. Certain entities must additionally conduct threat-led penetration testing.
Another focus is ICT third-party risk. Financial entities must maintain a register of information on their contractual arrangements and take account of prescribed contractual provisions. For services supporting critical or important functions, this also includes whether and under what conditions subcontracting is permitted. The exchange of cyber threat information between financial entities is voluntary under the conditions set out in the regulation.
On 18 November 2025, the European Supervisory Authorities published a first list of critical ICT third-party service providers. These providers are subject to a European oversight framework. Financial entities remain responsible for their own third-party risks.
What deadlines apply to incidents and tests
When an ICT-related incident is classified as major, the initial notification must be made as soon as possible. The deadline is no later than four hours after classification as major and, at the same time, no later than 24 hours after the financial entity becomes aware of the incident. The intermediate report follows no later than 72 hours after the initial notification. The final report must be submitted no later than one month after the intermediate report or the latest updated intermediate report. Details are set out in Delegated Regulation (EU) 2025/301.
Threat-led penetration testing, or TLPT, is intended for financial entities identified according to the legal criteria. For these entities, DORA generally requires such a test at least every three years. The competent authority may adjust the frequency under certain conditions.
How DORA and NIS2 interact
NIS2 is an EU directive on cybersecurity across several sectors. For financial entities within its scope, DORA is a sector-specific EU legal act within the meaning of Article 4 of the NIS2 Directive. The more specific DORA rules therefore apply to the relevant cybersecurity risk management and significant incident reporting requirements. This does not support a blanket conclusion that all other potential NIS2 obligations cease to apply. Entities should assess how they are affected based on their specific activities and national provisions.
Frequently asked questions
Each question is closed. Tap to reveal the answer.
When did DORA start to apply?
The regulation has applied since 17 January 2025. It applies directly in EU Member States.
Must every financial entity conduct a TLPT?
No. The obligation applies to entities identified under the criteria in the regulation. For these entities, the interval between tests is generally no more than three years.
Does DORA replace all NIS2 obligations?
For financial entities within its scope, the sector-specific DORA rules take precedence for the relevant risk management and incident reporting requirements. Other applicability must be assessed on a case-by-case basis.
Editor’s Picks
Editor’s PickDORA in Operation: What the Regulator Wants to SeeEditor’s PickFrom When the Reporting Deadline Clock Really Starts Ticking
More from the MBF Media Network
cloudmagazinKRITIS in the Cloud: What Secures the Migration
Image credit: AI-generated (July 2026), C2PA certificate embedded in the image
More from the MBF Media network
Image source: AI-generated (Juli 2026)
Translated from the German original using artificial intelligence. The German version is authoritative.
