DORA, digital operational resilience
The European regulation for the financial sector, which reaches all the way to those who provide it with IT services. Risk governance, incidents, testing and suppliers in modules that feed one another.
Finance and ICT providers
The Digital Operational Resilience Act (Regulation (EU) 2022/2554) has applied since 17 January 2025 to European financial entities: banks, insurers, investment firms, payment and electronic money institutions, fund managers and many other intermediaries.
The reason it also concerns non-financial companies is third-party ICT service providers. Financial entities must govern the risk arising from those who supply them with software, cloud, support and infrastructure, and they do so through contracts: security requirements, audit rights, incident notification, exit strategies.
Many software houses and infrastructure operators are discovering as a result that they have to demonstrate, to their banking or insurance customer, controls that nobody used to ask for.
The five pillars of the DORA regulation
- An ICT risk management framework, with the management body accountable
- An inventory of ICT functions, assets and dependencies
- Management, classification and reporting of major ICT-related incidents
- Digital operational resilience testing, proportionate to the entity
- Management of the risk arising from third-party ICT service providers
- A register of information on arrangements with ICT providers
- Minimum contractual clauses with providers
- Business continuity, backup and recovery
- Sharing of information on cyber threats
- Digital resilience training, including for senior management
A module for every DORA pillar
The DORA self-assessment tells you where you stand. Then risk governance, incidents, testing and suppliers do not become four separate projects, but modules that share data and owners.
| DORA requirement | How Dottor Box covers it |
|---|---|
| Measuring the gap | Gap analysis on the requirements of the regulation, with a simulation of the services to activate |
| ICT risk governance | Risk Assessment with a treatment plan, residual risk and an owner for every risk |
| ICT inventory | Asset Management and Attack Surface with how critical each asset is |
| ICT incidents | Incident Response and Data Breach: CSIRT, incident phases assigned and reports in PDF |
| Resilience testing | Vulnerability Assessment on the internal network, external network and web applications, with history |
| Continuity and backups | Business continuity: BIA, continuity plan and backup checks |
| Third-party ICT providers | Supply Chain: qualification questionnaires, answers and evidence from suppliers |
| Threat information | Threat Intelligence: the news that concerns your suppliers and your technologies |
When a customer sends you a DORA questionnaire
Documented answers
Vulnerability assessment, procedures, risk analysis and incident handling: the evidence to attach is already produced by the platform.
Continuity you can prove
The scan history and the archived reports prove that the controls have been running for a long time, not since yesterday.
A certified provider
Dottor Marc is certified to ISO/IEC 27001 and ISO 9001: this also counts as evidence in your supply chain.
The most demanding chapter of DORA is supplier oversight. Whether you are the bank doing the qualifying or the provider answering, the work is the same: evidence that is organised and up to date.
DORA: frequently asked questions
I am an ICT provider to a bank: does DORA apply to me?
The obligations of the regulation fall on the financial entity, but they reach you through the contract: security requirements, incident notification, audit rights, cooperation in testing. In practice you need to be able to demonstrate your controls. Providers designated as critical at European level are also subject to direct oversight by the authorities.
What is the difference between DORA and NIS2?
DORA is a regulation specific to the financial sector and, for those entities, takes precedence over NIS2 as the sector-specific law for ICT risk management. Many requirements are similar: risk analysis, incidents, suppliers, continuity.
Is a vulnerability assessment a resilience test?
It is one of the components of the testing required by the regulation, together with other checks proportionate to the entity. For the most significant entities DORA also requires threat-led penetration testing, which is a separate specialist activity.
What is the register of information required by DORA?
It is the list, which every financial entity must keep up to date, of all contractual arrangements with third-party ICT service providers, with the functions they support. It must be made available to the competent authority. If you are a provider, your financial customers will ask you for the information needed to complete it: qualification through the Supply Chain module keeps it in order.
How often must digital operational resilience testing be carried out?
DORA requires a testing programme with checks at least once a year on the ICT systems and applications that support critical or important functions. Entities identified by the authorities also carry out advanced testing, at least every three years. The scan history of the vulnerability assessment documents the periodic part.
The modules that work for DORA
Risk Assessment
Risk analysis based on ISO/IEC 27005, with a treatment plan and residual risk.
Learn more GovernIncident Response and Data Breach
CSIRT, incident handling phases and a breach register with notification deadlines.
Learn more GovernSupply Chain
Supplier assessment with questionnaires completed from a link, no accounts needed.
Learn more SeeVulnerability Assessment
Six checks from inside and outside, with CVSS severity, history and alerts on what is new.
Learn more GovernBusiness continuity
Business Impact Analysis, continuity plan and backup checks, guided by questionnaires.
Learn more SeeThreat Intelligence
News and threats that concern your industry and your suppliers, gathered into a digest.
Learn moreDo you know what someone looking for a target can see of your company?
In a demo on your real systems we show you what is exposed, how much it matters and where to start. Then, if you need it, a tailored proposal.