Digital Operational Resilience Act
An EU regulation requiring financial entities and their critical ICT providers to build and prove digital operational resilience — covering risk management, incident reporting, resilience testing and third-party oversight in a single harmonised framework.
Who it applies to
- Banks, insurers, investment firms and most other regulated financial entities in the EU
- ICT third-party service providers supporting critical or important financial functions
- Critical ICT providers designated for direct EU-level oversight
Key requirements
- A board-approved ICT risk management framework
- Classification and reporting of major ICT-related incidents
- Regular digital operational resilience testing, including threat-led penetration testing
- A structured register of information covering all ICT third-party arrangements
- Contractual provisions covering audit, exit and sub-outsourcing for critical ICT providers
Maximum penaltyDetermined at Member State level; periodic penalty payments of up to 1% of average daily worldwide turnover for critical ICT providers under direct oversight
Official resources
Praeferre's summary is a starting point, not legal advice. For the authoritative text and current guidance, go directly to the governing body.
Questions we get asked
DORA applies to: Banks, insurers, investment firms and most other regulated financial entities in the EU; ICT third-party service providers supporting critical or important financial functions; Critical ICT providers designated for direct EU-level oversight.
The core obligations are: A board-approved ICT risk management framework; Classification and reporting of major ICT-related incidents; Regular digital operational resilience testing, including threat-led penetration testing; A structured register of information covering all ICT third-party arrangements; Contractual provisions covering audit, exit and sub-outsourcing for critical ICT providers. Each is summarised in plain English above, with a link to the official text.
Effective: 17 January 2025. Regulator: European Supervisory Authorities (EBA, ESMA, EIOPA).
Determined at Member State level; periodic penalty payments of up to 1% of average daily worldwide turnover for critical ICT providers under direct oversight.
Praeferre's GRC Automation engine monitors the policies, document repositories and web pages that carry your risk under DORA, on a cadence you set, and turns every scan into an audit trail you can put in front of an auditor or regulator.
See how Praeferre automates DORA compliance
Continuous monitoring, evidence and reporting for DORA — alongside every other framework you need to satisfy.