A comprehensive EU regulation strengthening the ICT security and operational resilience of the financial sector, applicable from 17 January 2025.
The Digital Operational Resilience Act (DORA) is a landmark EU regulation that establishes a comprehensive framework for managing information and communication technology (ICT) risks in the financial sector. It addresses the growing digital transformation and increasing cyber threats facing financial institutions.
DORA aims to ensure that all participants in the financial system have the necessary safeguards in place to mitigate cyber attacks and ICT-related incidents, ensuring they can continue to provide critical services even under severe operational disruptions.
Unlike previous regulations that varied across EU member states, DORA creates a single, harmonized set of requirements that apply uniformly across the European Union, leveling the playing field and strengthening the overall resilience of the financial sector.
DORA is designed to achieve multiple critical goals for the financial sector
Ensure financial entities can withstand, respond to, and recover from ICT-related disruptions and threats
Create uniform rules across the EU, replacing fragmented national approaches to digital resilience
Establish oversight framework for critical ICT service providers to the financial sector
Facilitate exchange of cyber threat intelligence among financial entities
Key milestones in the implementation of the Digital Operational Resilience Act
DORA formally adopted by EU Parliament and Council as Regulation (EU) 2022/2554
DORA entered into force on 16 January 2023, beginning the transition period
ESAs developed and published regulatory and implementing technical standards
DORA became fully applicable - financial entities must be compliant
Competent authorities submit first registers to ESAs for CTPP designation
ESAs notify critical ICT third-party service providers of their designation
DORA applies to more than 21 types of financial entities and their critical ICT service providers
Note: DORA also applies to ICT third-party service providers designated as critical by the European Supervisory Authorities (ESAs), even if they are located outside the EU.
Financial entities must comply with comprehensive requirements across four main areas
DORA is structured around five interconnected pillars that work together to ensure digital operational resilience
📚 Learn more in our training section →Start with our comprehensive training modules and test your knowledge