DORA: what it requires and how to comply
The Digital Operational Resilience Act (DORA) is the European regulation requiring the financial sector to withstand, respond to and recover from technology incidents. It has been fully applicable since 17 January 2025, so it’s no longer a future project: it’s an obligation in force. And if you’re a technology provider to a financial entity, it reaches you through your client. Atalaya GRC helps you comply service by service, so you always know where each one stands.
No commitment. We’ll walk you through the platform with a real case.
- Reference
- Reg. (EU) 2022/2554
- Applies from
- 17 Jan 2025
- Who
- Financial entities and critical ICT providers
- If you don’t comply
- National penalties + direct EU supervision
What is the Digital Operational Resilience Act?
The Digital Operational Resilience Act is Regulation (EU) 2022/2554, mandatory since January 2025. It also creates a single harmonised framework for digital operational resilience in the European financial sector. Because it is a regulation and not a directive, it applies directly with no national transposition needed.
Who does the Digital Operational Resilience Act apply to?
The Digital Operational Resilience Act applies to more than 20 categories of financial entities —banks, insurers, investment firms, payment institutions, fund managers, crypto-asset service providers— and, very importantly, to their critical technology providers (CTPPs), which fall under direct oversight by the European authorities. Microenterprises, however, have a simplified, proportionate regime. In addition, many non-critical ICT providers feel its effects through their contracts, because financial entities must record them in their register of information on ICT third-party arrangements.
What does the Digital Operational Resilience Act require? (the 5 pillars)
The five pillars you have to cover:
ICT risk management
A comprehensive technology risk-management framework that also includes board-level accountability.
Incident management and reporting
Classify major incidents and then notify them to the authority within strict deadlines, using harmonised templates.
Resilience testing
Regular testing and, for designated entities, also TLPT (threat-led penetration testing) at least every 3 years.
What happens if you don’t comply?
The Digital Operational Resilience Act is hard law, supervised by European and national authorities, with formal reviews (on-site and off-site) and significant penalties for non-compliance. Third-party risk management and resilience testing are also where most entities fall short, making them the focus of supervision.
The other pillars of the Digital Operational Resilience Act
Beyond the three above, DORA also requires third-party risk management —a detailed register of ICT providers, contractual clauses and an exit strategy— and information sharing on threats between entities.
Atalaya GRC
How Atalaya GRC helps
Atalaya GRC turns DORA into something you control:
- Per-service compliance: each financial service with its real status against DORA, so gaps show up early.
- The 5 pillars centralised, with documentation, evidence and an audit trail for when the supervisor asks.
- The regulatory clock also tracks incident-reporting and testing deadlines.
- One control, several regulations: many DORA measures match those of NIS2; therefore, reuse what you have and work only on the delta (TLPT, ICT provider register).
Want to see it with your own services?
Request a demoBy sector: Banking and fintech Insurers
FAQ
Frequently asked questions
Since when is DORA mandatory?
It has been fully applicable since 17 January 2025 across the EU, with no national transposition required.
Who does DORA apply to?
EU financial entities (banks, insurers, fund managers, payment institutions, crypto…) and their critical technology providers.
Does DORA affect my company if I’m a bank’s provider?
In practice yes: your financial client will pass on DORA’s requirements by contract, and critical providers fall under direct oversight.
How is DORA different from NIS2?
For the financial sector, DORA prevails as the special rule. They share many measures, but DORA adds TLPT, a detailed ICT provider register and direct oversight of critical providers.
Atalaya GRC
How Atalaya GRC helps with DORA
End-to-end operational resilience: ICT risk register, business impact analysis (BIA with RTO/RPO), resilience testing, critical third-party oversight (TPRM) and on-time incident reporting.
