Question 1

What is the DORA regulation?

Accepted Answer

DORA (Digital Operational Resilience Act, EU 2022/2554) is an EU regulation on digital operational resilience for the financial sector. It has been in effect since January 17, 2025 and requires financial entities to implement ICT risk management frameworks, incident management, resilience testing, ICT third-party provider oversight, and cyberthreat information sharing arrangements.

Question 2

Who does DORA apply to?

Accepted Answer

DORA applies to over 22,000 financial entities in the EU, including banks, insurance companies, investment firms, payment institutions, crypto-asset service providers, as well as critical ICT third-party service providers serving the financial sector. The regulation applies a proportionality principle — requirements are tailored to the size and risk profile of the entity.

Question 3

What are the penalties for DORA non-compliance?

Accepted Answer

Supervisory authorities can impose administrative sanctions and financial penalties for DORA non-compliance. Critical ICT third-party providers can face penalties of up to 1% of average daily worldwide turnover for each day of infringement, for up to 6 months. Financial entities are subject to sanctions determined by national supervisory authorities in accordance with sectoral financial regulations.

Question 4

What are the 5 pillars of DORA?

Accepted Answer

DORA is built on 5 pillars: (1) ICT Risk Management — frameworks for identifying, protecting, detecting, and responding to ICT risks; (2) ICT Incident Management — classification, reporting, and analysis of incidents; (3) Digital Operational Resilience Testing — regular penetration testing and TLPT; (4) ICT Third-Party Risk Management — oversight of outsourcing and concentration risk; (5) Information Sharing — sharing cyberthreat data among financial entities.

DORA Readiness Assessment

Your DORA Readiness Score

Strengths

Areas for Improvement

Need help implementing DORA requirements?