Regulation (EU) 2022/2554
The five pillars of the Digital Operational Resilience Act, the clocks and registers they create, and how the regulation reaches ICT suppliers through their contracts.
DORA — the Digital Operational Resilience Act, Regulation (EU) 2022/2554 — has applied to EU financial entities since 17 January 2025. It requires banks, payment and e-money institutions, investment firms, insurers, crypto-asset service providers and more than a dozen other categories to run an ICT risk management framework, classify and report major ICT-related incidents, test their digital operational resilience, and manage the risk their ICT third-party providers create — including keeping a register of information on every contractual arrangement. As a regulation it applies directly, with technical detail in delegated and implementing acts. ICT providers to financial entities are reached through Article 30 contract terms, and the most critical are overseen directly by the European Supervisory Authorities.
Key takeaways
Scope
DORA lists who it covers by entity type rather than by size, then applies proportionality to how much each one has to do.
Requirements
Five chapters of obligations, each with a level-two act filling in the technical detail.
Art. 5–16
A documented framework covering identification, protection, detection, response and recovery, backup, learning and communication — owned by the management body, which bears ultimate responsibility. Delegated Regulation (EU) 2024/1774 sets out its elements.
Art. 17–23
An incident management process that classifies incidents against the criteria in Delegated Regulation (EU) 2024/1772 and reports major ones to the competent authority on the timeline in Delegated Regulation (EU) 2025/301.
Art. 24–27
A risk-based testing programme — vulnerability assessments, scenario tests, penetration tests — and, for entities their authority identifies, threat-led penetration testing at least every three years.
Art. 28
A strategy for ICT third-party risk, assessment before contracting, exit plans, and a register of information on every contractual arrangement, kept at entity and consolidated level and provided to the competent authority.
Art. 30
Mandatory contract terms with ICT providers: service descriptions and locations, availability and integrity, assistance in incidents, termination rights, and — for critical or important functions — audit rights, exit strategies and participation in testing.
Art. 31–44
Providers designated critical by the ESAs are overseen directly by a lead overseer, with powers to request information, inspect and issue recommendations.
Art. 45
Financial entities may exchange cyber threat information and intelligence among themselves within trusted communities.
Timeline
When DORA started to apply, when its level-two acts took effect, and the clock a major ICT-related incident starts.
Overlaps
DORA rarely arrives alone. Where it meets the other regimes you probably already run.
For financial entities DORA is the sector-specific act, so its ICT risk and incident rules apply in place of NIS2's. Groups with entities outside finance can owe both.
An ISMS covers a good part of the ICT risk management framework. It does not cover major-incident classification and reporting, threat-led testing or the register of information.
The register of information and Article 30 contract terms overlap with existing outsourcing registers, but cover all ICT arrangements, not only material outsourcing.
A major incident that involves personal data may need a DORA report and a GDPR breach notification — two authorities, two clocks.
On Noru
The same control library, evidence vault and registers as the rest of your programme — not a separate project.
Noru carries DORA for financial entities (103 controls), for ICT third-party providers (56) and for critical ICT third-party providers (92), mapped onto the same control library as ISO 27001 — so a supplier selling into banks and a bank buying from suppliers each run the version that fits them.
Noru assembles the register from the supplier records you already keep, checks it against the EBA's reference data and validation rules, and exports it as the xBRL-CSV report package the ESAs accept — only after someone approves it.
Controls are monitored from connected systems, and each one carries dated evidence with its provenance — a synced configuration, a register mirror or an uploaded document — that an inspection can trace.
Framework status reads from the live programme, and the audit package for DORA and a given period bundles controls, evidence, policies and milestones for export.
Indirectly, always; directly, sometimes. Every financial entity must put the Article 30 contract terms in place with its ICT providers, so suppliers meet DORA through their customers' contracts, audits and testing requests. Providers the European Supervisory Authorities designate as critical are also overseen directly under Articles 31 to 44.
A register, required by Article 28(3), of every contractual arrangement a financial entity has with ICT third-party service providers — who the provider is, which functions it supports, where data is processed, and how critical it is. It is kept at entity and consolidated level in the standard templates of Implementing Regulation (EU) 2024/2956 and provided to the competent authority.
When it is classified as major under the criteria in Delegated Regulation (EU) 2024/1772. The initial notification is due within 4 hours of classification and no later than 24 hours after becoming aware of the incident; the intermediate report within 72 hours of the initial notification; and the final report within a month of the latest intermediate report.
Only the financial entities their competent authority identifies, based on their systemic importance and ICT risk profile. They must run TLPT at least every three years. Every financial entity, however, needs a risk-based testing programme under Article 24.
Partly. Article 16 sets a simplified ICT risk management framework for certain smaller entities, such as small and non-interconnected investment firms and exempted payment institutions, and proportionality runs through the whole regulation. The incident reporting and third-party obligations still apply.
Regulatory references on this page were last checked on .
A 45-minute walkthrough of DORA against your own controls, integrations and evidence.
