Build DORA digital operational resilience without spreadsheets

DORA is the Digital Operational Resilience Act, Regulation (EU) 2022/2554. It is an EU regulation that sets a single set of rules for how financial entities manage ICT risk, report major ICT-related incidents, test their digital operational resilience and manage risk from ICT third-party providers. It also creates an EU oversight framework for critical ICT providers such as large cloud platforms. DORA entered into force on 16 January 2023 and has applied since 17 January 2025.

DORA applies to a wide range of EU financial entities, including credit institutions, payment and electronic money institutions, investment firms, crypto-asset service providers, trading venues, insurers and reinsurers, and certain pension and fund managers. ICT third-party service providers are affected indirectly through contractual requirements, and providers designated as critical are supervised directly. Smaller firms, such as some microenterprises, can use a simplified ICT risk management framework under Article 16.

DORA has applied since 17 January 2025. The regulation was published in the Official Journal of the EU on 27 December 2022 and entered into force on 16 January 2023, giving firms a two-year implementation period. Detailed regulatory and implementing technical standards that specify how firms must meet several articles were developed by the European Supervisory Authorities during that period and now apply alongside the main text.

Penalties for financial entities are set by each EU member state, and national competent authorities can impose administrative penalties and remedial measures under Article 50. Member states may also set criminal penalties. For critical ICT third-party service providers, the Lead Overseer can impose periodic penalty payments of up to 1% of the provider's average daily worldwide turnover in the preceding business year, charged daily for up to six months.

DORA has five core areas of obligation. Firms need an ICT risk management framework overseen by the management body, a process to classify and report major ICT-related incidents, a digital operational resilience testing programme, including threat-led penetration testing for some firms, and robust management of ICT third-party risk with a register of information and mandatory contract terms. It also allows voluntary sharing of cyber threat intelligence between financial entities.

DORA overlaps heavily with ISO 27001 on risk management, access control, incident handling, backup and supplier security, so an existing ISO 27001 programme gives a strong starting point. DORA adds sector-specific duties ISO 27001 does not, such as major incident reporting to regulators, threat-led penetration testing and specific contract clauses. For financial entities, DORA is treated as sector-specific law that takes precedence over the equivalent cybersecurity provisions of NIS2.

DORA applies to UK companies when they operate entities authorised in the EU or provide ICT services to EU financial entities, which must then flow DORA contract requirements down to them. UK firms that only serve the UK market are not directly in scope, as the UK has its own operational resilience rules from the Bank of England, PRA and FCA, including a regime for critical third parties.

Yes. DORA is supported in OneClickComply today. It shares controls with frameworks such as ISO 27001 and SOC 2, so evidence you collect once counts towards DORA too. OneClickComply provides a risk register, vendor risk management, automated evidence collection, continuous monitoring, penetration testing and access to our in-house audit team. OneClickComply does not certify DORA compliance, which is assessed by your regulator.