Who it covers
Banks, payment and e-money institutions, investment firms, insurers, crypto-asset service providers and other financial entities listed in Article 2. Critical ICT third-party providers come under direct EU oversight. Other ICT providers feel it through their customers' contracts.
The five pillars
- ICT risk management (Articles 5 to 16): a documented framework, with the management body accountable.
- ICT incident management and reporting (Articles 17 to 23): classify incidents and report major ones to the authority.
- Digital operational resilience testing (Articles 24 to 27): a testing programme and, for designated entities, threat-led penetration testing.
- ICT third-party risk (Articles 28 to 44): contract requirements, a register of information and exit strategies.
- Information sharing (Article 45): voluntary exchange of threat intelligence.
Where to start
- Confirm that you are covered and whether a simplified regime applies.
- Map your critical functions and the ICT supporting them.
- Build the register of information on your ICT contracts.
- Compare your incident process with the classification criteria and deadlines in the technical standards.
- Review contracts against Article 30.
Questions
- Is DORA a directive or a regulation?
- A regulation: it applies directly in all Member States, unlike NIS2, which is transposed into national law.
- Does DORA replace NIS2 for financial entities?
- DORA is the specific act for the financial sector on these subjects, so its rules take precedence for the entities it covers.