Digital Operational Resilience Act compliance for financial institutions. ICT risk management frameworks, incident reporting requirements, resilience testing (TLPT), third-party risk, and register of information obligations.
EU Regulation 2022/2554
The Digital Operational Resilience Act (DORA, Regulation 2022/2554) entered into application on 17 January 2025, mandating ICT risk management, incident reporting, resilience testing (TLPT), and third-party risk obligations for over 22,000 EU financial entities. Penalties under DORA can reach 1% of average daily worldwide turnover per day of infringement.
Begin with the foundational guides: DORA compliance overview, ICT risk management framework, and the Register of Information requirement. For operational obligations, see incident reporting timelines, threat-led penetration testing, and third-party risk management.
For sectoral guidance, our DORA for banks brief and non-compliance cost analysis for fintechs cover the priority verticals. To compare with adjacent regimes, see DORA vs GDPR overlap, DORA vs NIS2, and the unified incident reporting playbook. For tooling, the DORA software buyer's guide covers vendor selection criteria.
Latest 17 articles
A detailed breakdown of DORA ICT risk management requirements under Articles 5-16, covering governance, framework components, documentation, and the eligibility limits of the simplified regime.
Assess DORA testing duties, TLPT selection, the authority-approved scope, tester rules and evidence needed to close findings.
Map DORA, NIS2 and GDPR incident reporting by legal entity and threshold, with correct timelines, recipient routes and a worked bank/provider scenario.
A practical guide to DORA for financial entities: verify scope, apply ICT risk controls, report major incidents, test resilience and manage ICT suppliers.
Understand DORA national penalties, critical-provider payments, management responsibility and operational costs, then build a defensible fintech budget.
Guide to DORA third party risk management: mandatory contractual clauses, Register of Information, exit strategies, and ESA oversight of critical providers.
How to maintain DORA's ICT third-party register using the 2024/2956 templates, validate linked data and decide whether a spreadsheet or software fits.
DORA compliance for banks: TLPT requirements, Register of Information, board-level ICT governance, incident reporting, and an ongoing compliance roadmap.
A detailed guide to DORA incident reporting under Articles 17-23, covering classification criteria, three-stage reporting timelines, competent authorities, and how it differs from GDPR breach notification.
Overview of DORA penalties for financial entities, ICT providers, and individuals. Enforcement authorities, timelines, and comparison with GDPR and NIS2 fines.
Evaluate DORA software with register validation, incident-reporting and provider-exit trials. Scope, acceptance evidence and proposal questions for financial entities.
Select DORA software for a startup by legal entity scope, Article 16 eligibility, operational evidence, supplier workflows and a comparable written quote.
A practical review of privacy-workflow scope, evidence, implementation and procurement questions.
Guide to the DORA Register of Information required under Article 28(3), covering the ITS template with five relational tables, annual submission, and practical tips.
Side-by-side DORA vs GDPR overlap analysis: incident reporting, third-party management, risk frameworks, and a practical dual-compliance roadmap.
DORA vs NIS2 compared: scope, requirements, penalties, and timelines. How financial entities can comply with both EU cybersecurity regulations simultaneously.
DORA compliance software for enterprises 2026: multi-entity Register of Information, group ICT third-party risk, TLPT and GRC integration, tools compared.