The Digital Operational Resilience Act (DORA), officially Regulation (EU) 2022/2554 is a European Union regulation.[1] [2] It requires financial entities to improve their digital operational resilience.
DORA aims to improve the digital operational resilience of financial entities in the EU and their ICT suppliers and create a uniform regulatory framework across the EU, in order to reduce the susceptibility to cyber threats across the entire value chain of the financial sector. In addition, DORA intends to harmonize national regulations regarding the security of IT systems in the financial sector, thus strengthening the European financial market as a whole against cyber risks and information and communications technology incidents.
The regulation applies to financial entities and third-party suppliers of ICT services. Article 2 defines financial entities as:
The regulation explicitly does not apply to:
Article 4 defines the proportionality principle, resulting in some exceptions for smaller enterprises which fall within the scope of the regulation despite their size. This allows for a simplified implementation of certain requirements in accordance with the overall risk profile of the enterprise. An example for this is the simplified ICT risk management framework according to Article 16 in combination with a regulatory technical standard (RTS).
The regulation comprises 64 articles divided into 9 chapters:
In addition, the European Supervisory Authorities develop regulatory and implementing technical standards (RTS and ITS), which, being published in the Official Journal of the European Union, also become legally binding:
| Type | Subject | DORA reference | Implemented | Status | |
|---|---|---|---|---|---|
| RTS | ICT risk management framework | Art. 15 | Commission Delegated Regulation (EU) 2024/1774 | In force | |
| RTS | Simplified ICT risk management framework | Art. 16 (3) | Commission Delegated Regulation (EU) 2024/1774 | In force | |
| RTS | Classification of ICT-related incidents and cyber threats | Art. 18 (3) | Commission Delegated Regulation (EU) 2024/1772 | In force | |
| RTS | Content of the reports for major ICT-related incidents | Art. 20 (a) | Adopted October 23, 2024; pending publication in Official Journal | ||
| ITS | Standard forms, templates and procedures for financial entities to report a major ICT-related incident | Art. 20 (b) | Final draft published July 17, 2024 | ||
| RTS | Threat-led penetration testing | Art. 26 (11) | Final draft published July 17, 2024 | ||
| ITS | Standard templates for the purposes of the register of information | Art. 28 (9) | Draft rejected by the Commission on September 3, 2024 | ||
| RTS | Policy on the use of ICT services supporting critical or important functions provided by ICT third-party service providers (third-party policy) | Art. 28 (10) | Commission Delegated Regulation (EU) 2024/1773 | In force | |
| RTS | Specification of elements when subcontracting ICT services supporting critical or important functions | Art. 30 (5) | Final draft published July 26, 2024 | ||
| Guidelines | Cooperation between the ESAs and the competent authorities regarding the structure of the oversight framework | Art. 32 (7) | Published November 6, 2024 | ||
| RTS | Harmonisation of conditions enabling the conduct of the oversight activities | Art. 41 | Adopted October 24, 2024; pending publication in Official Journal |