DORA guide: does it apply to you and what must you arrange?

Short answer: DORA — the Digital Operational Resilience Act, Regulation (EU) 2022/2554 — has applied directly across the EU since 17 January 2025. It requires financial entities to demonstrably manage their digital resilience. If you are in scope, five pillars apply: ICT risk management, incident reporting, resilience testing, third-party ICT risk management and (voluntary) information sharing.

Does DORA apply to my institution?

DORA sets out an exhaustive list of financial entities. These include banks (credit institutions), payment institutions, electronic money institutions, investment firms, crypto-asset service providers, insurers and reinsurers, insurance intermediaries, fund managers, and their critical ICT service providers. Small, non-interconnected and micro-enterprises may use a simplified ICT risk framework (proportionality). In the Netherlands, DNB and AFM supervise. If you are also an essential sector under NIS2 — say a carrier holding a payment licence — DORA applies as the more specific rule to that financial part. See DORA or NIS2: which applies?.

The five pillars

1. ICT risk management — a governance framework with ultimate responsibility at board level. See ICT risk management under DORA.
2. Incident reporting — classifying and reporting major ICT incidents to the supervisor. See Incident reporting under DORA.
3. Resilience testing — regular testing, with threat-led penetration testing (TLPT) for significant entities. See Resilience testing and TLPT.
4. Third-party ICT risk — contractual requirements, a register of information and oversight of critical ICT providers. See Third-party ICT risk and oversight.
5. Information sharing — voluntary exchange of threat intelligence between entities.

Where to start

First determine whether you are an in-scope entity and whether the simplified framework applies. Then map your ICT dependencies and outsourcing (the register), set up the risk-management and incident processes, and plan the testing cycle. The detailed requirements are in the technical standards (RTS/ITS) from EBA, EIOPA and ESMA.

Lees ook: AI Act and DORA interplay.