DORA harmonises digital operational resilience requirements for covered financial entities, including ICT risk, incidents, testing and third-party exposure.
What it is
DORA establishes a harmonised EU framework for managing information and communication technology (ICT) risk in the financial sector. It links governance, operational continuity, testing and third-party dependencies.
What it covers
The regulation addresses covered financial entities and, in specific contexts, critical ICT third-party service providers. It includes ICT risk management, incident processes, resilience testing and contractual oversight.
Why it matters for digital autonomy
Digital autonomy includes understanding technology dependencies and having credible continuity options. DORA brings those concerns into a regulated operational-resilience model for the financial sector.
Dates and status
DORA has applied since 17 January 2025. Regulatory technical standards and supervisory requirements should be considered alongside the regulation itself.
Practical questions for organisations
- Confirm whether the organisation falls under DORA and which supervisory requirements apply.
- Inventory critical ICT services and contractual dependencies.
- Test operational recovery, escalation and supplier exit planning.
Official reference
Read the source document on the issuing organisation’s website.
This is an educational reference, not legal advice, certification or a determination of applicability. Check the authoritative text and relevant national rules before making decisions.