The Digital Operational Resilience Act (DORA) is a Regulation of the European Union (EU), officially designated as Regulation (EU) 2022/2554. It was adopted on December 14, 2022, and became fully applicable on January 17, 2025. DORA was created to solve the problem of fragmented and inconsistent Information and Communication Technology (ICT) risk management rules across the EU's financial sector, which left the system vulnerable to systemic failures and cyberattacks. Before DORA, regulations primarily focused on ensuring financial institutions had enough capital to cover operational risks, failing to comprehensively address ICT-related risks.
DORA works by establishing a unified, binding framework for ICT risk management for approximately 22,000 financial entities, including banks, insurance companies, investment firms, and their critical ICT third-party service providers. Its mechanism is built on five key pillars: requirements for ICT risk management; procedures for ICT-related incident management, classification, and reporting to competent authorities; a framework for digital operational resilience testing, including threat-led penetration testing (TLPT) every three years; rules for managing ICT third-party risk; and mechanisms for information sharing on cyber threats.
DORA connects to the NIS 2 Directive (Directive on measures for a high common level of cybersecurity across the Union), which is a broader regulatory framework covering critical infrastructure. However, for financial entities, DORA is the sector-specific legal act that takes precedence, meaning its provisions apply instead of those outlined in NIS 2 for ICT risk management and incident notification, as long as DORA's requirements are at least equivalent in effect. DORA replaced the previous fragmented approach where operational resilience requirements were scattered across sector-specific directives. The core concept of strengthening the financial sector's ability to withstand and recover from ICT disruptions remains the same, but DORA introduced a comprehensive, harmonized, and legally binding set of technical standards.