European Union

DORA — Digital Operational Resilience Act

The Digital Operational Resilience Act, Regulation (EU) 2022/2554, applies to financial entities in the European Union from 17 January 2025. It requires them to manage ICT risk under a documented framework, classify and report major ICT-related incidents within fixed clocks, test their digital resilience, control the risk from ICT third-party providers and keep a register of those arrangements, and it brings critical ICT third-party providers under direct oversight.

DORA asks financial entities to demonstrate resilience, not describe it. DECIMA produces the demonstration from the systems that already run.

At a glance

Issued by

European Parliament and Council, Regulation (EU) 2022/2554, with technical standards from the European Supervisory Authorities

Applies to

Banks, insurers, investment firms, payment and e-money institutions, crypto-asset service providers and other financial entities in the EU, plus their ICT third-party providers

In force

Applies from 17 January 2025

Supervised by

National competent authorities, with the ESAs overseeing critical ICT third-party providers

What the mandate requires

The obligations as the regulation states them, in the order a programme meets them.

1. 01

   ICT risk management framework

   A documented, board-approved framework covering identification, protection, detection, response and recovery for all ICT assets, reviewed at least yearly.

2. 02

   ICT-related incident reporting

   Major incidents classified against common criteria and reported to the competent authority: an initial notification within four hours of classification and no later than 24 hours from awareness, an intermediate report within 72 hours, and a final report within one month.

3. 03

   Digital operational resilience testing

   A yearly testing programme for all critical ICT systems, and threat-led penetration testing at least every three years for entities the authority designates.

4. 04

   ICT third-party risk

   Contracts with ICT providers that contain the mandated clauses, concentration risk assessed, exit strategies in place, and a register of information on all ICT third-party arrangements maintained and submitted on request.

5. 05

   Information sharing

   Arrangements for exchanging cyber threat information with other financial entities, within trusted communities.

How DECIMA evidences it

Each requirement is answered from live systems with a dated, re-verifiable record, not from a questionnaire completed for the assessment.

• Framework controls read continuously

  The controls the ICT risk framework names are read from the systems that operate them on a schedule, each read stored with its timestamp and the framework version, so the yearly review is a report on the year.

• Incident clocks met from the record

  Incidents are classified against DORA’s criteria from the evidence DECIMA already holds, and the initial, intermediate and final notifications are drafted from that record inside the four-hour, 72-hour and one-month clocks.

• Register of information kept current

  ICT third-party arrangements, their contractual clauses and concentration are held as structured records and exported in the format the authority requests.

• Testing evidenced as it runs

  Resilience tests and threat-led penetration tests are recorded with scope, findings and remediation, linked to the controls they exercised.

04

Questions buyers ask

Short answers you can quote.