Article 2 lists the financial entities and exclusions. Financial entities carry the main resilience duties; ICT third-party providers have contract obligations, while providers formally designated critical face the separate EU oversight framework. The obligations are proportionate to an entity's size, risk profile and activities, with specific simplified provisions for certain categories.
Law and regulation / Directly applicable EU regulation
DORADigital operational resilience in EU finance
DORA gives EU financial entities a common operating framework for ICT risk, major incidents, resilience testing and ICT third-party dependencies. Its core question is whether a financial service can remain dependable through serious technology disruption.
Start with applicability
What it actually covers
Financial services depend on software, networks and external ICT providers. A local failure can disrupt payments, markets or customers, so DORA couples preventive controls with tested recovery, incident intelligence and visibility into outsourced dependencies.
DORA is law, not a certification. The most advanced threat-led penetration testing applies to selected entities, not every firm. A third-party contract does not transfer the financial entity's responsibility. For covered financial entities, DORA is the sector-specific ICT regime in its overlap with NIS2; GDPR duties for personal data continue separately.
The substance
Key areas to understand
An original operational reading of the official framework or legal text. Check the source for the authoritative wording.
Governance and ICT risk
The management body directs and oversees a documented ICT risk framework. Identify functions, information and ICT assets, dependencies, security measures, response capabilities and recovery objectives, then review effectiveness.
Incident classification and reporting
Record ICT incidents, classify major events using the applicable criteria and submit staged reports to the competent authority. Current delegated rules set the initial notice within four hours of major classification and no later than 24 hours after awareness, subject to the late-classification rule; the intermediate report follows within 72 hours of the initial notice.
Operational resilience testing
Use a risk-based test program spanning assessments and technical tests. Selected entities must perform advanced threat-led penetration testing under the specified criteria; ordinary testing still matters for others.
ICT third-party risk
Maintain a register of contractual arrangements for ICT services, understand which providers support critical or important functions, assess concentration and exit risk, and include required written terms for security, assistance, access, audit, continuity and termination as applicable.
Critical-provider oversight and sharing
The EU supervisory authorities can designate critical ICT third-party providers for direct oversight. Financial entities may also participate in cyber-threat information-sharing arrangements under DORA's conditions.
From reference to work
A practical starting sequence
These steps organize work; they are not a claim that a short checklist completes the requirement.
Map critical functions and technology
Trace each important financial service to its applications, data, infrastructure, people and ICT providers, including single points of failure and recovery paths.
Build and reconcile the ICT provider register
Tie procurement and contract inventories to the DORA register, identify critical or important functions, assign owners and capture subcontracting and location changes.
Rehearse severe disruption
Test detection, classification, regulatory notice, customer impact, technical restoration and the decision to invoke an alternate provider or exit plan.
Review test and incident lessons at management level
Turn findings into tracked remediation, retest controls, and use management review to resolve risk exceptions and investment priorities.
Make it inspectable
Evidence to look for
The right records depend on the entity, scope and chosen assessment route.
- ICT risk framework and asset map
Approved policies, function and asset inventories, dependency diagrams, risk assessments, recovery targets and management review records.
- Incident case file
Detection, awareness and classification timestamps, impact analysis, regulator submissions, updates and post-incident improvements.
- Test program
Test scope, methods, independence where required, results, remediation and retest proof; threat-led tests where the entity is designated for them.
- Third-party register and contracts
A current register, provider due diligence, function criticality, contractual clauses, audit/access evidence and feasible exit plans.
Illustrative situation
What this could look like
An EU payment institution in DORA’s scope loses an outsourced identity service. Its dependency map reveals affected payment functions; the response team classifies the disruption, records when it was detected and when it became major, starts the DORA reporting route, invokes a tested continuity path, and later updates the provider register and exit plan.
Keep the role clear
DORA is law, not a certification. The most advanced threat-led penetration testing applies to selected entities, not every firm. A third-party contract does not transfer the financial entity's responsibility. For covered financial entities, DORA is the sector-specific ICT regime in its overlap with NIS2; GDPR duties for personal data continue separately.
Related, not equivalent
Where ISO/IEC can help
ISO/IEC 27001 can structure the security management system; 27017 helps cloud control discussions, 27035 helps incident handling and 27036 helps supplier assurance. DORA adds financial-sector duties, technical standards, deadlines and contractual requirements that ISO certification does not replace.
Common distinctions
Questions worth asking
Does DORA apply to every ICT vendor serving a bank?
Financial entities have the main legal duties and must manage ICT providers. A vendor's obligations depend on its contracts and whether it is designated as a critical ICT third-party provider for EU oversight; do not assume every vendor is directly regulated in the same way.
Must every financial entity run threat-led penetration testing?
No. DORA requires a broader risk-based testing program, while advanced threat-led penetration testing applies only to entities identified under its criteria.
Does DORA replace GDPR or all NIS2 duties?
No. GDPR remains relevant where personal data is processed. DORA is the sector-specific ICT regime for financial entities in the relevant NIS2 overlap; check remaining national and supervisory duties.
Primary-source trail
Read the official material
Research checked 2026-10-20. Edition, applicability and implementation rules can change. The links below take you to the responsible publisher or authority.