What is DORA?
DORA, the Digital Operational Resilience Act, is Regulation (EU) 2022/2554. It sets uniform rules for how the EU financial sector manages ICT risk, so that banks, insurers, payment institutions and other financial entities can withstand, respond to and recover from ICT disruptions and cyber attacks.
DORA has applied since 17 January 2025. As a regulation it applies directly in every EU member state, and the management body of each financial entity is responsible for ICT risk. DORA is not a certification: there is no DORA certificate, and compliance is checked by the competent supervisory authorities.
Who must comply with DORA?
- Credit institutions and banks
- Payment institutions and electronic money institutions
- Investment firms and other capital market participants
- Insurance and reinsurance undertakings
- Crypto-asset service providers authorised under MiCA
- ICT third-party service providers to financial entities; critical ones are directly overseen by the European Supervisory Authorities (EBA, EIOPA, ESMA)
What the DORA self-assessment checks
The questions follow the five pillars of the regulation:
- ICT risk management framework: governance, role of the management body, asset inventory, protection, detection, backup and recovery
- ICT-related incident management, classification and reporting of major incidents to the supervisor
- Digital operational resilience testing, including threat-led penetration testing (TLPT) for significant entities
- ICT third-party risk management: due diligence, contractual requirements, exit strategies and the register of information
- Information sharing on cyber threats and vulnerabilities
Typical DORA compliance gaps
- The ICT risk framework exists on paper, but the management body has not approved or reviewed it
- There are no criteria for classifying incidents as major, so the reporting deadlines cannot be met
- The register of information on ICT third-party arrangements is incomplete or outdated
- Contracts with ICT providers lack the clauses DORA requires, such as audit rights and exit plans
- Backups and recovery plans are not tested regularly, and there is no testing programme
DORA, ISO 27001 and next steps
An information security management system under ISO/IEC 27001 helps a lot, but it does not cover everything DORA requires, for example the incident reporting deadlines, the register of information or TLPT. The self-assessment shows what you already have and what is missing.
IT vendors outside the EU, for example in Ukraine, Georgia or Kazakhstan, that serve EU banks and fintechs meet DORA requirements through client contracts, audits and security questionnaires. Use the gap report to prepare evidence, and optionally practise the conversation with an auditor in the BALTUM AI audit simulator.