What is DORA?
The Digital Operational Resilience Act (DORA) is an EU regulation that harmonises how financial entities manage ICT risk. Because it is a regulation, not a directive, it applies directly in every member state without national transposition. DORA entered into force on 16 January 2023 and applies from 17 January 2025.
DORA is supported by regulatory and implementing technical standards (RTS and ITS) from the European Supervisory Authorities (EBA, EIOPA and ESMA). These define details such as incident classification, reporting templates and the register of information on ICT third-party arrangements.
Who does DORA apply to?
Article 2 lists around twenty types of financial entities, including:
- Credit institutions, payment institutions and electronic money institutions.
- Investment firms, crypto-asset service providers and trading venues.
- Insurance and reinsurance undertakings and insurance intermediaries (with exceptions for micro and small intermediaries).
- Management companies, alternative investment fund managers and institutions for occupational retirement provision.
- Credit rating agencies, crowdfunding service providers and central counterparties.
What are the five pillars of DORA?
| Pillar | What it requires | DORA articles |
|---|---|---|
| ICT risk management | A documented ICT risk-management framework owned by the management body | Articles 5–16 |
| ICT-related incident reporting | Classify incidents; report major incidents to the competent authority | Articles 17–23 |
| Digital operational resilience testing | Regular testing; threat-led penetration testing (TLPT) for selected entities at least every three years | Articles 24–27 |
| ICT third-party risk | Contract requirements, exit strategies and a register of information on all ICT providers | Articles 28–44 |
| Information sharing | Voluntary sharing of cyber threat information between financial entities | Article 45 |
What are the DORA incident-reporting deadlines?
Under the technical standards, a major ICT-related incident requires an initial notification within 4 hours of classifying it as major and no later than 24 hours after becoming aware of it, an intermediate report within 72 hours of the initial notification, and a final report within one month of the latest intermediate report.
How does ComplyPilot support DORA?
ComplyPilot (EU compliance platform) includes a DORA framework with requirements grouped by the five pillars and a DORA advisor dashboard. Requirements are linked to the same controls, policies, risks and evidence you use for ISO 27001 and NIS2, so an ICT risk-management policy or a backup test log only needs to be documented once.
The supplier module records ICT third-party providers with criticality and review frequency, which helps you prepare the register of information. Tasks with owners and due dates track remediation, and exports give your auditor or supervisor a structured view.
Spreadsheets vs enterprise GRC vs ComplyPilot for DORA
| Criterion | Spreadsheets | Enterprise GRC | ComplyPilot |
|---|---|---|---|
| Five-pillar structure | Build yourself | Yes | Yes |
| Shared controls with ISO 27001 and NIS2 | No | Often | Yes |
| ICT provider tracking | Separate sheet | Yes | Yes |
| Suited to smaller fintechs and payment institutions | Yes | Often oversized | Yes |
Frequently asked questions
When does DORA apply?
DORA applies from 17 January 2025 in all EU member states.
Does DORA replace NIS2 for financial entities?
For financial entities, DORA is the sector-specific act (lex specialis). Where DORA applies, its ICT risk-management and incident-reporting rules take precedence over the equivalent NIS2 provisions.
Do ICT providers have to comply with DORA?
ICT third-party providers are affected through their contracts with financial entities. Providers designated as critical (CTPPs) are also directly overseen by the European Supervisory Authorities.
Is DORA testing the same as a penetration test?
Not entirely. All in-scope entities need a testing programme; only entities selected by their authority must run threat-led penetration testing (TLPT), at least every three years.