What is DORA? Protecting the EU in 2025

1. Enhancing ICT Risk Management

One of the primary focuses of DORA is the strengthening of ICT risk management practices across the financial sector. The regulation mandates that financial entities:

• Implement and maintain resilient ICT systems and tools
• Identify and classify all ICT-related business functions
• Set clear ICT risk tolerance levels
• Implement protective measures against ICT incidents
• Detect anomalous activities promptly
• Establish business continuity and disaster recovery plans

DORA also requires financial entities to conduct regular assessments of their ICT risk management framework and to continuously improve their ICT-related capabilities.

2. Harmonized Incident Reporting

Recognizing the importance of timely and consistent incident reporting, DORA establishes a harmonized framework for ICT-related incident reporting across the EU. Key elements include:

• Classification of ICT-related incidents based on specific criteria
• Mandatory reporting of significant incidents to competent authorities
• Standardized reporting templates and timeframes
• Requirements for root cause analysis and follow-up reports

This harmonized approach aims to provide supervisory authorities with a comprehensive view of ICT-related incidents across the financial sector, enabling more effective oversight and response.

3. Digital Operational Resilience Testing

DORA mandates regular testing of ICT systems to ensure their resilience. This includes:

• Basic testing such as vulnerability assessments and network security scans
• Advanced testing like penetration tests and red team exercises for significant financial entities
• Threat-led penetration testing (TLPT) for the most critical financial entities

These testing requirements are designed to help financial entities identify vulnerabilities, assess their response capabilities, and continuously improve their digital operational resilience.

4. Managing ICT Third-Party Risk

Acknowledging the financial sector’s increasing reliance on third-party ICT service providers, DORA introduces a comprehensive framework for managing ICT third-party risk. Key provisions include:

• Mandatory contractual arrangements covering key aspects of service provision
• Monitoring of ICT third-party service providers’ performance and security
• Exit strategies to reduce the risk of vendor lock-in
• An oversight framework for critical ICT third-party service providers

DORA also introduces the concept of “critical ICT third-party service providers,” subjecting them to direct oversight by European Supervisory Authorities.

5. Information Sharing on Cyber Threats

To enhance the sector’s collective resilience, DORA encourages the sharing of cyber threat information among financial entities. It proposes the establishment of arrangements for the exchange of cyber threat information and intelligence, while ensuring compliance with data protection regulations.

6. Enhanced Supervisory Framework

DORA strengthens the ability of supervisory authorities to oversee the digital operational resilience of financial entities. It grants these authorities new powers, including:

• The ability to request information and documentation related to ICT risk management
• The power to conduct on-site inspections
• The authority to issue recommendations and binding instructions

This enhanced supervisory framework aims to ensure consistent application of DORA across the EU and to enable swift regulatory action when necessary.