Digital Operational Resilience Act (DORA)

What it is

Regulation (EU) 2022/2554, the Digital Operational Resilience Act, sets uniform requirements for how financial entities manage ICT risk so they can withstand, respond to and recover from ICT disruptions and cyber attacks. It brings ICT risk management, incident reporting, resilience testing and the management of ICT third-party providers into one regulation, and creates an EU oversight regime for critical ICT providers to the financial sector.

Who it applies to

• Banking and payments: credit institutions, payment institutions, account information service providers and electronic money institutions
• Investment and markets: investment firms, crypto-asset service providers and issuers of asset-referenced tokens, central securities depositories, central counterparties, trading venues, trade repositories, data reporting service providers, securitisation repositories and administrators of critical benchmarks
• Asset management: managers of alternative investment funds and UCITS management companies
• Insurance and pensions: insurance and reinsurance undertakings, insurance and reinsurance intermediaries (including ancillary intermediaries) and institutions for occupational retirement provision
• Other financial entities: credit rating agencies and crowdfunding service providers; microenterprises and some smaller entities benefit from proportionality or a simplified ICT risk management framework
• ICT third-party service providers: indirectly through their financial entity customers' contracts, and directly when designated as critical ICT third-party service providers and overseen by the European Supervisory Authorities

Key points

• ICT risk management framework: the management body has ultimate responsibility for ICT risk (Article 5) and the entity must maintain a documented framework covering identification, protection and prevention, detection, response and recovery, backup and restoration, learning and communication, reviewed at least yearly
• Major ICT-related incident reporting: incidents are classified using harmonised criteria, and major ones are reported to the competent authority through an initial notification, an intermediate report and a final report on deadlines set in the technical standards; significant cyber threats may be reported voluntarily
• Digital operational resilience testing: a risk-based testing programme, with tests of systems supporting critical or important functions at least yearly, and threat-led penetration testing (TLPT) on live production systems at least every three years for entities identified by their authorities
• ICT third-party risk and the register of information: entities need a third-party risk strategy and must keep a register of all contractual arrangements for ICT services, which they report to their competent authority, and must assess concentration risk before contracting
• Contract terms: Article 30 lists mandatory contract provisions, such as service descriptions and locations, data protection, access and audit rights, termination rights and, for critical or important functions, service levels, participation in testing and exit support
• Exit strategies: for ICT services supporting critical or important functions, entities must have documented, tested exit strategies and transition plans so they can leave a provider without disrupting their business or breaching regulation
• Oversight of critical ICT third-party service providers: the ESAs designate critical providers, which are then subject to direct oversight, inspections and recommendations by a Lead Overseer

Where to start

1. 1Confirm your entity type and whether the simplified framework or proportionality applies, then identify your critical or important functions
2. 2Assess your ICT risk management framework against Chapter II and Delegated Regulation (EU) 2024/1774, and get the management body to approve it
3. 3Build and maintain the register of information for all ICT third-party arrangements, review contracts against Article 30, and write exit plans for providers supporting critical or important functions
4. 4Align incident classification and reporting with the DORA criteria and deadlines, and plan a testing programme including any TLPT your authority requires