EU Digital Operational Resilience Act (Regulation (EU) 2022/2554) and its technical standards: ICT risk management, incident reporting, resilience testing, ICT third-party risk, information sharing, supervision, and the delegated and implementing regulations that detail them.
DORA Chapter II (Articles 5 to 16) with the proportionality principle of Article 4: governance, the ICT risk management framework, identification, protection, detection, response and recovery, backup, learning, communication and the simplified regime.
DORA Chapter III (Articles 17 to 23): the incident management process, classification of incidents and cyber threats, mandatory reporting of major incidents, voluntary notification of significant cyber threats, and payment-related incidents.
DORA Chapter IV: the testing programme, basic testing of ICT tools and systems, threat-led penetration testing and requirements for testers.
DORA Chapter V: Section I (Articles 28 to 30) on how financial entities manage ICT third-party risk and contract for ICT services, and Section II (Articles 31 to 44) on the EU oversight framework for critical ICT third-party service providers.
DORA Chapter VI (Article 45) on cyber threat information sharing among financial entities, and Chapter VII on which authorities supervise DORA compliance and the administrative penalties and remedial measures member states must provide.
The Commission delegated and implementing regulations that supplement DORA, drafted by the ESAs through their Joint Committee: ICT risk management, incident classification and reporting, the register of information, ICT services policy and subcontracting, TLPT, and oversight of critical providers.
What DORA's ICT risk management standard (Delegated Regulation (EU) 2024/1774) requires for specific security measures: encryption and keys, logging, vulnerability and patch management, networks, access and identity, change, secure development, operations, endpoints and physical security.
The documents DORA runs on and who signs them off: the full list of required policies, the resilience strategy, risk assessment and residual risk, the asset inventory, continuity testing, the framework review report, management body duties and internal audit.
How DORA lands on each kind of financial entity: banks, payment and e-money institutions, investment firms, insurers, fund managers, pension funds, market infrastructures and microenterprises, with the sectoral directives Directive (EU) 2022/2556 amended.
Practical third-party decisions under DORA: identifying critical or important functions, deciding what counts as an ICT service, open-source and self-hosted software, exit plans, due diligence and assurance, cloud providers and intra-group services.
Testing under DORA outside the TLPT regime: penetration and security testing every entity needs, lighter testing for small firms, testing that involves ICT providers, and remediating what tests find.
Running ICT incidents under DORA beyond the reporting deadlines: telling clients, outsourcing reporting, estimating annual costs and losses, handling recurring incidents and post-incident reviews.
Buyer guides for organizations that must comply with DORA or serve financial entities that do: scope, gap analysis, the register of information, incident reporting, TLPT, contracts, ICT providers, critical providers, cost, NIS2 and penalties.
Tell us what you're working on, whether it's a deployment, an audit, a security test or a cyber range. You'll speak with an engineer who can help you scope it.