DORA (Digital Operational Resilience Act)

What is DORA (Digital Operational Resilience Act)?

DORA (Digital Operational Resilience Act), Regulation (EU) 2022/2554, is the European regulation harmonizing digital operational resilience requirements across the financial sector. It has applied since 17 January 2025 and covers banks, insurers, investment firms, payment institutions, crypto-asset service providers, and the critical ICT third parties serving them.

What DORA requires

• An ICT risk management framework, owned and approved by the management body.
• Classification and reporting of major ICT-related incidents to the competent authority, on regulated deadlines.
• Digital operational resilience testing, including threat-led penetration testing for significant entities.
• Management of ICT third-party risk, with a register of information covering every contractual arrangement.
• Contractual requirements toward ICT providers, including access, audit, and exit conditions.

The third-party register is where most programs stall

DORA requires a register of information covering every contractual arrangement for ICT services, with the functions supported and their criticality assessed. A financial entity running 150 SaaS applications has to list them, all of them, with the right attributes. Firms discover at that point that procurement records and the actual estate diverge, and that closing the divergence is the deliverable the supervisor asked for.

Examples and use cases

A payment institution builds its register from contract records and lists 61 ICT providers. Discovery against spend and OAuth data returns 104 applications in active use, twelve of them supporting functions the firm classifies as important. The distance between those two numbers is not negligence, it is the normal state of an undiscovered estate. Corma provides the continuous inventory that keeps the register aligned with reality rather than with the last procurement cycle.

Related concepts

• Automated identity governance and administration
• Automated and compliant access reviews
• IAM for security teams

FAQ

Who does DORA apply to?

Around twenty categories of EU financial entities, from credit institutions to crypto-asset service providers, plus the ICT third-party providers designated as critical.

Since when does DORA apply?

It has applied since 17 January 2025, following its entry into force in January 2023, which gave entities a two-year preparation window.

What is the DORA register of information?

A structured record of every contractual arrangement for ICT services, including the provider, the function supported, and whether that function is critical or important.

How does DORA relate to NIS2?

Both raise cyber resilience obligations in the EU. DORA is sector-specific for finance and takes precedence for entities within its scope, while NIS2 covers a broader set of essential and important sectors.

Request a demo