{"id":21978,"date":"2026-07-06T09:00:00","date_gmt":"2026-07-06T09:00:00","guid":{"rendered":"https:\/\/www.securitytoday.de\/2026\/07\/06\/what-is-dora-definition-obligations-deadlines\/"},"modified":"2026-11-03T14:46:37","modified_gmt":"2026-11-03T14:46:37","slug":"what-is-dora-definition-obligations-deadlines","status":"publish","type":"post","link":"https:\/\/www.securitytoday.de\/en\/2026\/07\/06\/what-is-dora-definition-obligations-deadlines\/","title":{"rendered":"What is DORA? Definition, duties and deadlines"},"content":{"rendered":"<p><strong>The Digital Operational Resilience Act, or DORA, has applied since 17 January 2025. The EU regulation requires financial entities within its scope to manage their digital risks and report major ICT-related incidents. It also sets requirements for testing and the management of ICT service providers. The specific obligations depend in part on the type and size of the entity.<\/strong><\/p>\n<div style=\"background:#003340;color:#fff;padding:32px 36px;margin:32px 0;border-radius:8px;\">\n<p style=\"color:#69d8ed;text-transform:uppercase;letter-spacing:0.08em;font-size:0.82em;font-weight:700;margin:0 0 16px;\">Key takeaways<\/p>\n<ul style=\"margin:0;padding-left:20px;line-height:1.7;\">\n<li style=\"margin-bottom:10px;\"><strong style=\"color:#69d8ed;\">DORA has applied since 17 January 2025.<\/strong> The EU regulation is directly applicable.<\/li>\n<li style=\"margin-bottom:10px;\"><strong style=\"color:#69d8ed;\">Its scope is broad.<\/strong> It covers banks, insurers and other regulated financial entities, among others. Exemptions must be assessed on a case-by-case basis.<\/li>\n<li style=\"margin-bottom:0;\"><strong style=\"color:#69d8ed;\">The obligations extend beyond contracts.<\/strong> They also cover risk management, incident reporting and resilience testing.<\/li>\n<\/ul>\n<\/div>\n<h2>What DORA regulates and who is affected<\/h2>\n<p>DORA is <a href=\"https:\/\/eur-lex.europa.eu\/eli\/reg\/2022\/2554\/oj\" target=\"_blank\" rel=\"noopener\">Regulation (EU) 2022\/2554<\/a> on digital operational resilience for the financial sector. It establishes requirements for managing risks arising from information and communication technology, or ICT. As a regulation, it applies directly in EU Member States.<\/p>\n<p>Entities covered include credit institutions, insurance and reinsurance undertakings, investment firms, payment institutions, electronic money institutions, certain crypto-asset service providers and fund managers. The regulation contains exemptions and provides for simplified requirements for certain entities. Entities should therefore assess their status against Article 2 and the relevant individual provisions.<\/p>\n<h2>What obligations DORA covers<\/h2>\n<p>The management body is responsible for ICT risk management. This includes a digital operational resilience strategy and documented procedures to protect systems and restore them after disruptions. The requirements must be applied proportionately, taking into account factors such as the entity&#8217;s size, risk profile and complexity.<\/p>\n<p>Financial entities must record and classify ICT-related incidents. Major incidents must be reported to the competent authority. DORA also requires a digital operational resilience testing programme. Certain entities must additionally conduct threat-led penetration testing.<\/p>\n<p>Another focus is ICT third-party risk. Financial entities must maintain a register of information on their contractual arrangements and take account of prescribed contractual provisions. For services supporting critical or important functions, this also includes whether and under what conditions subcontracting is permitted. The exchange of cyber threat information between financial entities is voluntary under the conditions set out in the regulation.<\/p>\n<p>On 18 November 2025, the European Supervisory Authorities published a <a href=\"https:\/\/www.eba.europa.eu\/publications-and-media\/press-releases\/european-supervisory-authorities-designate-critical-ict-third-party-providers-under-digital\" target=\"_blank\" rel=\"noopener\">first list of critical ICT third-party service providers<\/a>. These providers are subject to a European oversight framework. Financial entities remain responsible for their own third-party risks.<\/p>\n<h2>What deadlines apply to incidents and tests<\/h2>\n<p>When an ICT-related incident is classified as major, the initial notification must be made as soon as possible. The deadline is no later than four hours after classification as major and, at the same time, no later than 24 hours after the financial entity becomes aware of the incident. The intermediate report follows no later than 72 hours after the initial notification. The final report must be submitted no later than one month after the intermediate report or the latest updated intermediate report. Details are set out in <a href=\"https:\/\/eur-lex.europa.eu\/eli\/reg_del\/2025\/301\/oj\" target=\"_blank\" rel=\"noopener\">Delegated Regulation (EU) 2025\/301<\/a>.<\/p>\n<p>Threat-led penetration testing, or TLPT, is intended for financial entities identified according to the legal criteria. For these entities, DORA generally requires such a test at least every three years. The competent authority may adjust the frequency under certain conditions.<\/p>\n<h2>How DORA and NIS2 interact<\/h2>\n<p>NIS2 is an EU directive on cybersecurity across several sectors. For financial entities within its scope, DORA is a sector-specific EU legal act within the meaning of Article 4 of the NIS2 Directive. The more specific DORA rules therefore apply to the relevant cybersecurity risk management and significant incident reporting requirements. This does not support a blanket conclusion that all other potential NIS2 obligations cease to apply. Entities should assess how they are affected based on their specific activities and national provisions.<\/p>\n<h2 style=\"padding-top:64px;margin-bottom:20px;\">Frequently asked questions<\/h2>\n<p class=\"st-faq-hint\">Each question is closed. Tap to reveal the&nbsp;answer.<\/p>\n<details>\n<summary><strong>When did DORA start to apply?<\/strong><\/summary>\n<p style=\"margin:8px 0 4px 24px;color:#555;line-height:1.6;\">The regulation has applied since 17 January 2025. It applies directly in EU Member States.<\/p>\n<\/details>\n<details>\n<summary><strong>Must every financial entity conduct a TLPT?<\/strong><\/summary>\n<p style=\"margin:8px 0 4px 24px;color:#555;line-height:1.6;\">No. The obligation applies to entities identified under the criteria in the regulation. For these entities, the interval between tests is generally no more than three years.<\/p>\n<\/details>\n<details>\n<summary><strong>Does DORA replace all NIS2 obligations?<\/strong><\/summary>\n<p style=\"margin:8px 0 4px 24px;color:#555;line-height:1.6;\">For financial entities within its scope, the sector-specific DORA rules take precedence for the relevant risk management and incident reporting requirements. Other applicability must be assessed on a case-by-case basis.<\/p>\n<\/details>\n<p><!--ST-LOWER-CARDS lang=en--><\/p>\n<h3 style=\"margin:48px 0 18px;font-size:1.05em;font-weight:800;color:#e6e3da;line-height:1.2;\">Editor&#8217;s Picks<\/h3>\n<p><a href=\"https:\/\/www.securitytoday.de\/en\/2026\/06\/29\/dora-in-operation-what-the-regulator-wants-to-see\/\" style=\"display:flex;align-items:center;gap:14px;padding:12px 14px;margin:0 0 10px;background:#23261f;border:1px solid rgba(105,216,237,0.18);border-radius:12px;box-shadow:0 6px 18px rgba(0,0,0,0.22);text-decoration:none;color:#e6e3da;box-sizing:border-box;width:100%;\"><span style=\"flex:0 0 116px;aspect-ratio:16\/9;overflow:hidden;border-radius:8px;background:#111210;border:1px solid rgba(230,227,218,0.08);display:block;\"><img decoding=\"async\" src=\"https:\/\/www.securitytoday.de\/wp-content\/uploads\/2026\/06\/dora-finanzinstitute-resilienz-nachweis-tlpt-cover-hero-250x141.jpg\" alt=\"\" loading=\"lazy\" width=\"116\" height=\"65\" style=\"width:100%;height:100%;object-fit:cover;display:block;\"><\/span><span style=\"display:block;min-width:0;\"><span style=\"display:block;font-size:0.68em;font-weight:700;letter-spacing:0.1em;text-transform:uppercase;color:#69d8ed;margin-bottom:5px;\">Editor&#8217;s Pick<\/span><span style=\"display:block;font-size:1.0em;font-weight:650;line-height:1.35;color:#e6e3da;overflow-wrap:anywhere;\">DORA in Operation: What the Regulator Wants to See<\/span><\/span><\/a><a href=\"https:\/\/www.securitytoday.de\/en\/2026\/06\/25\/from-when-the-reporting-deadline-clock-really-starts-ticking\/\" style=\"display:flex;align-items:center;gap:14px;padding:12px 14px;margin:0 0 10px;background:#23261f;border:1px solid rgba(105,216,237,0.18);border-radius:12px;box-shadow:0 6px 18px rgba(0,0,0,0.22);text-decoration:none;color:#e6e3da;box-sizing:border-box;width:100%;\"><span style=\"flex:0 0 116px;aspect-ratio:16\/9;overflow:hidden;border-radius:8px;background:#111210;border:1px solid rgba(230,227,218,0.08);display:block;\"><img decoding=\"async\" src=\"https:\/\/www.securitytoday.de\/wp-content\/uploads\/2026\/07\/nis2-dora-dsgvo-meldefristen-vergleich-startpunkt-incident-cover-hero-1-250x143.jpg\" alt=\"\" loading=\"lazy\" width=\"116\" height=\"65\" style=\"width:100%;height:100%;object-fit:cover;display:block;\"><\/span><span style=\"display:block;min-width:0;\"><span style=\"display:block;font-size:0.68em;font-weight:700;letter-spacing:0.1em;text-transform:uppercase;color:#69d8ed;margin-bottom:5px;\">Editor&#8217;s Pick<\/span><span style=\"display:block;font-size:1.0em;font-weight:650;line-height:1.35;color:#e6e3da;overflow-wrap:anywhere;\">From When the Reporting Deadline Clock Really Starts Ticking<\/span><\/span><\/a><\/p>\n<h3 style=\"margin:48px 0 18px;font-size:1.05em;font-weight:800;color:#e6e3da;line-height:1.2;\">More from the MBF Media Network<\/h3>\n<p><a href=\"https:\/\/www.cloudmagazin.com\/en\/2026\/06\/29\/kritis-in-the-cloud-what-secures-the-migration\/\" style=\"display:flex;align-items:center;gap:14px;padding:12px 14px;margin:0 0 10px;background:#23261f;border:1px solid rgba(105,216,237,0.18);border-radius:12px;box-shadow:0 6px 18px rgba(0,0,0,0.22);text-decoration:none;color:#e6e3da;box-sizing:border-box;width:100%;\"><span style=\"flex:0 0 116px;aspect-ratio:16\/9;overflow:hidden;border-radius:8px;background:#111210;border:1px solid rgba(230,227,218,0.08);display:block;\"><img decoding=\"async\" src=\"https:\/\/www.securitytoday.de\/wp-content\/uploads\/2026\/11\/net-kritis-cloud-migration-c5-nis2-dachgeset-54268377.jpg\" alt=\"\" loading=\"lazy\" width=\"116\" height=\"65\" style=\"width:100%;height:100%;object-fit:cover;display:block;\"><\/span><span style=\"display:block;min-width:0;\"><span style=\"display:block;font-size:0.68em;font-weight:700;letter-spacing:0.1em;text-transform:uppercase;color:#0bb7fd;margin-bottom:5px;\">cloudmagazin<\/span><span style=\"display:block;font-size:1.0em;font-weight:650;line-height:1.35;color:#e6e3da;overflow-wrap:anywhere;\">KRITIS in the Cloud: What Secures the Migration<\/span><\/span><\/a><!--\/ST-LOWER-CARDS--><\/p>\n<p style=\"font-style:italic;text-align:right;font-size:0.85em;margin-top:8px;\">Image credit: AI-generated (July 2026), C2PA certificate embedded in the image<\/p>\n<h3>More from the MBF Media network<\/h3>\n<ul>\n<li><a href=\"https:\/\/www.cloudmagazin.com\/en\/2026\/06\/29\/kritis-in-the-cloud-what-secures-the-migration\/\">Critical infrastructure in the cloud: What safeguards migration<\/a><\/li>\n<\/ul>\n<p style=\"text-align:right;\"><em>Image source: AI-generated (Juli 2026)<\/em><\/p>\n","protected":false},"excerpt":{"rendered":"DORA has applied since January 2025. The regulation covers ICT risks, incident reporting and resilience testing in the financial sector.","protected":false},"author":50,"featured_media":20758,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_yoast_wpseo_focuskw":"DORA regulation","_yoast_wpseo_title":"What is DORA? Definition, duties and deadlines","_yoast_wpseo_metadesc":"What DORA requires of financial entities: scope, ICT risks, reporting deadlines, resilience testing and its relationship with NIS2.","_yoast_wpseo_meta-robots-noindex":"","_yoast_wpseo_meta-robots-nofollow":"","_yoast_wpseo_meta-robots-adv":"","_yoast_wpseo_canonical":"","_yoast_wpseo_opengraph-title":"","_yoast_wpseo_opengraph-description":"","_yoast_wpseo_opengraph-image":"","_yoast_wpseo_opengraph-image-id":0,"_yoast_wpseo_twitter-title":"","_yoast_wpseo_twitter-description":"","_yoast_wpseo_twitter-image":"","_yoast_wpseo_twitter-image-id":0,"evm_kih_original":false,"_evm_slot_owner":"","evm_cvss":0,"evm_risk":0,"evm_casefile":"","evm_primary_cve":"","evm_pin_until":0,"evm_external_preview_token":"","evm_external_preview_expires":"","_evm_translation_lang":"en","featured_post":0,"featured_post_sortierung":0,"_wp_old_slug":[],"footnotes":""},"categories":[263],"tags":[],"class_list":["post-21978","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-sicherheitslexikon-en"],"evm_reading_time_minutes":5,"wpml_language":"en","wpml_translation_of":20746,"_links":{"self":[{"href":"https:\/\/www.securitytoday.de\/en\/wp-json\/wp\/v2\/posts\/21978","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.securitytoday.de\/en\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.securitytoday.de\/en\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.securitytoday.de\/en\/wp-json\/wp\/v2\/users\/50"}],"replies":[{"embeddable":true,"href":"https:\/\/www.securitytoday.de\/en\/wp-json\/wp\/v2\/comments?post=21978"}],"version-history":[{"count":5,"href":"https:\/\/www.securitytoday.de\/en\/wp-json\/wp\/v2\/posts\/21978\/revisions"}],"predecessor-version":[{"id":26383,"href":"https:\/\/www.securitytoday.de\/en\/wp-json\/wp\/v2\/posts\/21978\/revisions\/26383"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.securitytoday.de\/en\/wp-json\/wp\/v2\/media\/20758"}],"wp:attachment":[{"href":"https:\/\/www.securitytoday.de\/en\/wp-json\/wp\/v2\/media?parent=21978"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.securitytoday.de\/en\/wp-json\/wp\/v2\/categories?post=21978"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.securitytoday.de\/en\/wp-json\/wp\/v2\/tags?post=21978"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}