The Digital Operational Resilience Act (DORA), Regulation (EU) 2022/2554, has applied since January 17, 2025. For financial entities operating in the EU, DORA is now an active compliance requirement rather than a future regulatory initiative.
DORA establishes a common framework for managing ICT risk, reporting major ICT-related incidents, testing digital operational resilience, managing ICT third-party risk, and sharing cyber threat intelligence. It also introduces an EU-level oversight framework for critical ICT third-party service providers.
By 2026, organizations should be focused on maintaining operational compliance, keeping their ICT third-party registers accurate, meeting incident reporting timelines, testing resilience, and continuously monitoring ICT risks.
In this blog, we explain the five pillars of DORA, current compliance requirements, and the practical steps financial entities should take to maintain DORA readiness.
Key Takeaways
- DORA has applied across the EU financial sector since January 17, 2025.
- The regulation is built around ICT risk management, incident reporting, resilience testing, ICT third-party risk, and information sharing.
- Financial entities must maintain a register of contractual arrangements with ICT third-party service providers.
- Major ICT-related incidents follow defined initial, intermediate, and final reporting timelines.
- Certain financial entities must perform advanced Threat-Led Penetration Testing.
- Critical ICT third-party providers are subject to EU-level oversight by the European Supervisory Authorities.
What Is the Digital Operational Resilience Act (DORA)?
DORA is an EU regulation designed to strengthen the digital operational resilience of the financial sector.
It requires financial entities to maintain the ability to withstand, respond to, and recover from ICT-related disruptions while continuing to deliver critical and important business functions.
DORA covers five core areas:
- ICT risk management
- ICT-related incident management and reporting
- Digital operational resilience testing
- ICT third-party risk management
- Information and intelligence sharing
The regulation also establishes oversight of critical ICT third-party service providers whose services may create significant concentration or systemic risks across the EU financial system.
DORA has applied since January 17, 2025, making these requirements part of ongoing operational compliance for entities within scope.
Why DORA Matters in 2026 ?
Financial institutions depend heavily on cloud services, software platforms, data providers, networks, and other ICT services. A disruption at either the financial entity or a critical technology provider can affect financial services across multiple organizations.
DORA creates a consistent EU framework for managing these risks.
Instead of treating cybersecurity, incident response, business continuity, resilience testing, and ICT third-party risk as separate activities, DORA brings them together under one digital operational resilience framework.
For organizations in 2026, the focus has shifted from preparing for DORA to demonstrating that these processes operate continuously and can withstand regulatory scrutiny.
Who Does the DORA – Regulation (EU) 2022/2554 Apply To?
DORA applies to a broad range of EU financial entities. ICT third-party service providers are also affected through contractual requirements and, for providers designated as critical, the EU-level oversight framework.
Financial entities covered by the DORA Regulation include:
- Credit, payments, and electronic money institutions
- Crypto-asset service providers and issuers of asset-referenced tokens
- Account information and crypto asset service providers
- Investment firms, central securities depositories, trade repositories
- Central counterparties and trading venues
- Managers of alternative investment funds and management companies
- Data reporting service providers and securitization repositories
- Insurance and reinsurance undertakings
- Insurance, reinsurance, and ancillary insurance intermediaries
- Institutions for occupational retirement provision and credit rating agencies
- Administrators of critical benchmarks and crowdfunding service providers
So, what are the key requirements of the DORA Regulation? Let’s check them out in the following section.
The 5 Pillars of DORA Compliance
1. ICT Risk Management
Financial entities must maintain an ICT risk management framework that helps them identify, protect against, detect, respond to, and recover from ICT-related risks.
This includes asset and dependency identification, security controls, business continuity, disaster recovery, backup procedures, incident detection, and continuous improvement.
2. ICT-Related Incident Management and Reporting
Organizations must establish processes to detect, classify, manage, document, and report ICT-related incidents.
Major ICT-related incidents must follow DORA’s required reporting process, including initial, intermediate, and final reports within applicable timelines.
3. Digital Operational Resilience Testing
Financial entities must regularly test ICT systems and controls to identify weaknesses before they cause disruption.
Testing may include vulnerability assessments, scenario-based testing, penetration testing, business continuity exercises, and Threat-Led Penetration Testing (TLPT) where required.
4. ICT Third-Party Risk Management
Organizations must manage risks introduced by cloud providers, software vendors, data providers, and other ICT third parties.
This includes assessing providers before engagement, reviewing contractual requirements, monitoring critical services, managing concentration risk, maintaining exit strategies, and evaluating subcontracting dependencies.
5. Information and Intelligence Sharing
DORA allows financial entities to participate in trusted arrangements for sharing cyber threat information and intelligence.
This may include indicators of compromise, attack techniques, cybersecurity alerts, and defensive measures that help strengthen collective resilience.
DORA ICT Third-Party Register Requirements
Financial entities must maintain a Register of Information covering contractual arrangements with ICT third-party service providers.
The register should provide visibility into:
- ICT providers and services used
- Services supporting critical or important functions
- Contractual dependencies
- Relevant subcontracting arrangements
- Concentration risks
- Key service and provider information
Keeping this register accurate and current is an important part of ongoing DORA compliance and regulatory oversight.
DORA Compliance Checklist for 2026
- Maintain an approved ICT risk management framework.
- Identify critical ICT systems, assets, and dependencies.
- Maintain business continuity and disaster recovery procedures.
- Establish ICT incident classification and reporting processes.
- Keep the ICT third-party Register of Information current.
- Review ICT contracts for applicable DORA requirements.
- Assess concentration and third-party dependencies.
- Conduct resilience testing and TLPT where applicable.
- Track remediation activities and maintain compliance evidence.
- Review DORA controls as systems, providers, and risks change.
Benefits of Using the Digital Operational resilience Act DORA – Regulation (EU) 2022/2554
Both businesses and consumers can gain from implementing the Digital Operational Resilience Act (DORA) – Regulation (EU) 2022/2554 in several ways. These include:
- Improved Cybersecurity: DORA requires strong cybersecurity protocols, enhancing defenses against online threats and weaknesses in digital services.
- Increased Resilience: DORA improves operational resilience by allowing organizations to implement risk management frameworks and backup plans, guaranteeing the continuation of vital services.
- Improved Consumer Trust: Adherence to DORA gives customers assurance about the dependability and security of digital services, which promotes loyalty and trust.
- Streamlined Compliance: Establishing uniform standards throughout the EU using DORA makes it easier for businesses to adhere to regulations in several jurisdictions.
- Prompt Incident Response: DORA enables early reporting of incidents to help minimize the effect of cybersecurity incidents and facilitates a quick response.
- Innovation Support: Besides advancing cybersecurity, DORA seeks to stimulate innovation by elucidating and directing compliance requirements and fostering responsible digital transformation.
In general, DORA helps fortify the EU’s digital infrastructure, protecting companies and customers from cyberattacks while encouraging innovation and expansion in the digital sector.
DORA Compliance Readiness with Akitra!
Establishing trust is a crucial competitive differentiator when courting new SaaS businesses in today’s era of data breaches and compromised privacy. Customers and partners want assurances that their organizations are doing everything possible to prevent disclosing sensitive data and putting them at risk, and compliance certification fills that need.
Akitra offers an industry-leading, AI-powered Compliance Automation platform for SaaS companies. With its expertise in technology solutions and compliance, Akitra is well-positioned to assist companies in navigating the complexities of these frameworks and can provide invaluable guidance in implementing the necessary frameworks and processes.
Using automated evidence collection and continuous monitoring, together with a full suite of customizable policies and controls as a compliance foundation, our compliance automation platform and services help our customers become compliance-ready for DORA regulations as well as other regulatory frameworks, such as SOC 1, SOC 2, HIPAA, GDPR, PCI DSS, ISO 27001, ISO 27701, ISO 27017, ISO 27018, ISO 9001, ISO 13485, ISO 42001, NIST CSF, NIST 800-53, NIST 800-171, NIST 800-218, NIST AI RMF, FedRAMP, CCPA, CMMC, SOX ITGC, and more such as CIS AWS Foundations Benchmark, Australian ISM and Essential Eight etc. In addition, companies can use Akitra’s Risk Management product for overall risk management using quantitative methodologies such as Factorial Analysis of Information Risks (FAIR) and qualitative methods, including NIST-based for your company, Vulnerability Assessment and Pen Testing services, Third Party Vendor Risk Management, Trust Center, and AI-based Automated Questionnaire Response product to streamline and expedite security questionnaire response processes, delivering huge cost savings. Our compliance and security experts provide customized guidance to navigate the end-to-end compliance process confidently. Last but not least, we have also developed a resource hub called Akitra Academy which provides easy-to-learn short video courses on security, compliance, and related topics of immense significance for today’s fast-growing companies.
The benefits of our solution include enormous savings in time, human resources, and cost savings, including discounted audit fees with our audit firm partners. Customers can achieve compliance certification fast and cost-effectively, stay continuously compliant as they grow, and become certified under additional frameworks from our single compliance automation platform.
Build customer trust. Choose Akitra TODAY!
To book your FREE DEMO, contact us right here.
