ICT risk management
A governance and control framework approved by the management body.
DORA · Regulation (EU) 2022/2554
DORA: digital operational resilience for the financial sector
We help you comply with DORA, whether you are a European financial entity or an ICT service provider to one.
What is DORA?
Mandatory since January 2025
DORA is a European regulation directly applicable since 17 January 2025: it needs no national law and is the same across the European Union.
It requires banks, insurers, payment institutions, asset managers, crypto-asset providers and other financial entities to withstand, respond to and recover from ICT incidents.
It also reaches their ICT service providers: contracts must include specific clauses and critical providers come under the oversight of European authorities.
The five pillars
What the regulation requires
ICT incidents
Classification, handling and reporting of major incidents to the authority.
Resilience testing
An annual testing program and, for significant entities, threat-led penetration testing (TLPT) every three years.
ICT third-party risk
Register of information, contractual clauses and exit strategy.
Information sharing
Arrangements to share threat intelligence.
Phases
How we approach it
- 1Applicability and proportionality analysis by entity type and size.
- 2Gap assessment against the regulation and its technical standards.
- 3ICT risk management framework, policies and the management body’s role.
- 4Register of information on ICT providers and contract review.
- 5Incident classification and reporting, and resilience testing program.
- 6Internal audit and support before the supervisor.
If you are an ICT provider
What your financial clients will ask of you
Contractual clauses
Service levels, data location, audit, notification and exit.
Participation in testing
Cooperate with your client’s resilience testing, including TLPT.
Incident management
Report quickly and provide information for regulatory notification.
Evidence of controls
ISO 27001, SOC 2 or audits that back up your security.
ICT providers designated as critical come under the direct oversight of the European Supervisory Authorities.
Why DORA
Resilience as an advantage
Service continuity
Your financial services withstand incidents and recover quickly.
Demonstrable compliance
You reach the inspection with organized evidence.
Providers under control
You know and manage the risk across your ICT chain.
Integration with ISO
You build on ISO 27001 and ISO 22301.
Who it applies to
Financial entities and their ICT providers
- Banks and credit institutions
- Payment and e-money institutions
- Insurers and reinsurers
- Fund managers and investment firms
- Crypto-asset service providers
- Fintechs with a European license
- Cloud and ICT service providers
- Financial software providers
FAQ
What clients ask us most
What is DORA?
It is Regulation (EU) 2022/2554 on digital operational resilience for the financial sector. It unifies requirements for ICT risk management, incidents, testing and third parties.
Since when has it been mandatory?
Since 17 January 2025, directly in every European Union country.
Does it affect providers outside the European Union?
Yes. Financial entities must impose contractual requirements on all their ICT providers, wherever they are.
How does it relate to NIS2?
DORA is the sector-specific rule for finance: where they overlap, its requirements take precedence over NIS2.
Do you work with the European financial sector?
We measure your DORA gap and build the plan to comply, as an entity or as a provider.