It already applies
DORA has been in force since 17 January 2025. Competent authorities now expect a documented ICT risk framework, a complete Register of Information, and the ability to report a major incident within hours.
The EU's ICT resilience rulebook for the financial sector.
DORA, Regulation (EU) 2022/2554, is the EU's directly applicable rulebook for the digital operational resilience of the financial sector, and it has applied since 17 January 2025. It makes your management body own ICT risk and sets hard requirements across five pillars: ICT risk management, incident classification and reporting, resilience testing, ICT third-party risk (including the Register of Information), and information sharing.
The standard
Digital Operational Resilience Act, Regulation (EU) 2022/2554
Who needs it
Financial entities operating in the EU, and the ICT third-party providers that serve them: banks, insurers, investment firms, payment and e-money institutions, crypto-asset service providers, asset managers, trading venues and more.
17 Jan 2025
DORA has applied since
The basics
DORA is a Regulation, not a certification standard, so there is no Annex A and no Statement of Applicability. The Articles and their technical standards (the RTS and ITS) are the requirements, and what applies to you is driven by your entity type, whether a service supports a critical or important function, and your size tier.
It binds financial entities operating in the EU (banks, insurers, investment firms, payment and e-money institutions, crypto-asset service providers, asset managers, trading venues and more) along with the ICT providers that serve them. Providers designated as critical fall under a dedicated EU oversight framework.
Why it matters
DORA has been in force since 17 January 2025. Competent authorities now expect a documented ICT risk framework, a complete Register of Information, and the ability to report a major incident within hours.
You must keep a Register of Information on every ICT contractual arrangement, assess concentration risk, hold the mandatory Article 30 clauses, and have tested exit plans for the services that support critical functions.
A major incident triggers staged reporting to your competent authority: an initial notification within hours, an intermediate report, and a final report within one month.
A management-body-owned framework covering governance, identification, protection, detection, response and recovery, backup, learning and communication (Art 5 to 16).
Classify ICT-related incidents against the materiality thresholds and run the staged initial, intermediate and final reports to your authority (Art 17 to 23).
A risk-based testing programme over every system supporting a critical function, plus threat-led penetration testing at least every three years for identified entities (Art 24 to 27).
The Register of Information, the Article 30 contract clauses, concentration and exit strategies, and EU oversight of critical ICT providers (Art 28 to 44).
Done by hand, DORA means a sprawling spreadsheet Register of Information, incident timers tracked from memory, scattered test evidence, and contract reviews that never quite line up with Article 30. That is exactly the deadline-driven, repeatable work software should run for you.
Do it once, reuse it everywhere. Evidence you collect for DORA is automatically mapped to every other framework whose controls it also satisfies — and since these standards overlap heavily, most of that work isn't repeated.
See exactly how Compliance One maps DORA to your environment in a 30-minute walkthrough — and how much of it we handle for you.