Digital Operational Resilience Act (DORA)
DORA became fully applicable on 17 January 2025. It creates a single, harmonised EU framework for ICT risk management, incident reporting, resilience testing, third-party risk, and information sharing across the financial sector.
Who it applies to
EU financial entities: banks, insurers, investment firms, fund managers, crypto-asset service providers, and their critical ICT third-party providers.
How ISO-STANDARD.app helps with DORA
10 in-depth articles
The five pillars of DORA explained
Understand DORA's structure and you understand every ESA technical standard that flows from it.
ICT risk management
The framework: strategy, policies, procedures, protocols and tools for managing ICT risk. Board approval and annual review are mandatory.
ICT incident reporting
Classification, notification to competent authorities, and voluntary reporting of significant cyber threats. Timelines mirror NIS2 for major incidents.
Digital operational resilience testing
Regular testing of ICT systems. Significant entities do Threat-Led Penetration Testing (TLPT) at least every three years.
ICT third-party risk
Register of information for all third-party providers, contractual requirements, exit strategies, concentration risk assessment.
Information sharing
Voluntary but structured sharing of cyber threat intelligence between financial entities to raise collective resilience.
How ISO-STANDARD.app helps with DORA
Inside the workspace, this topic maps to concrete artefacts: pre-loaded DORA controls with crosswalks to ISO 27001, Evidence Vault items with signed timestamps, policy templates with attestation tracking, and a Trust Center page you can share with buyers on demand. You don't have to build a compliance system from scratch — you configure one that already knows the DORA shape.
The DORA third-party register: what to record
Article 28 requires a specific register format — the ESAs published the exact fields.
The register fields
50+ mandatory fields per contract: LEI codes, functions supported, criticality, sub-contracting chain, data location, exit strategy availability. This is not an inventory — it's a regulatory return.
Submitted, not just kept
The register is submitted annually to your competent authority. They aggregate it to identify concentration risk across the EU financial system.
Critical vs non-critical
You classify each function the supplier supports as critical or important, or not. The classification drives the contract clauses and testing depth.
Sub-contracting depth
You must know who your provider's sub-contractors are, at least for critical functions. Cloud hyperscalers must accept this transparency by contract.
How ISO-STANDARD.app helps with DORA
Inside the workspace, this topic maps to concrete artefacts: pre-loaded DORA controls with crosswalks to ISO 27001, Evidence Vault items with signed timestamps, policy templates with attestation tracking, and a Trust Center page you can share with buyers on demand. You don't have to build a compliance system from scratch — you configure one that already knows the DORA shape.
DORA TLPT: threat-led penetration testing in practice
TLPT is TIBER-EU rebadged. It's not a normal pentest — it's a full red-team exercise on production.
Who does it
Significant financial entities identified by their competent authority. Not every DORA-scoped firm; the threshold catches the systemically important ones.
Frequency
At least every three years. Some authorities push shorter cycles for the largest firms.
Threat intelligence-led
The scenarios are built from real, current threat intelligence tied to your organisation — not generic. A threat intelligence provider is part of the mandated team.
Certified providers only
Testers must be certified — and the certification landscape is still bedding in. Book your provider early; there aren't many.
How ISO-STANDARD.app helps with DORA
Inside the workspace, this topic maps to concrete artefacts: pre-loaded DORA controls with crosswalks to ISO 27001, Evidence Vault items with signed timestamps, policy templates with attestation tracking, and a Trust Center page you can share with buyers on demand. You don't have to build a compliance system from scratch — you configure one that already knows the DORA shape.
DORA incident classification: the RTS explained
Not every incident is 'major'. The RTS gives you a scoring test with specific thresholds.
The criteria
Clients affected, geographic spread, duration, data losses, reputational impact, economic impact, criticality of services affected. Each has thresholds you score against.
Major vs significant cyber threat
A major incident triggers formal reporting. A significant cyber threat (imminent, not realised) triggers voluntary reporting — highly encouraged and increasingly expected.
Documentation
For every classification decision, document the reasoning. Auditors and supervisors sample these and disagreements are not unusual.
Aggregation
Multiple small incidents that share a root cause may be aggregated into one major incident. Watch for this pattern in your log.
How ISO-STANDARD.app helps with DORA
Inside the workspace, this topic maps to concrete artefacts: pre-loaded DORA controls with crosswalks to ISO 27001, Evidence Vault items with signed timestamps, policy templates with attestation tracking, and a Trust Center page you can share with buyers on demand. You don't have to build a compliance system from scratch — you configure one that already knows the DORA shape.
The mandatory DORA contract clauses
Article 30 sets clauses you cannot leave out — for both critical and non-critical services.
Common clauses
Full description of services, locations of data processing, service levels, security requirements, personal data protection, access/inspection/audit rights, cooperation with authorities, termination rights.
Additional clauses for critical services
Detailed service level descriptions with quantitative and qualitative performance targets, notice periods for changes, exit strategy, testing participation, sub-contracting restrictions.
Hyperscaler pushback
Some standard cloud contracts don't include all clauses — you may need enterprise agreements or specific DORA addenda. Start negotiations early.
Contract inventory
Auditors will sample contracts against the required clauses. Maintain a contract inventory tagged by clause presence, not just a filing cabinet.
How ISO-STANDARD.app helps with DORA
Inside the workspace, this topic maps to concrete artefacts: pre-loaded DORA controls with crosswalks to ISO 27001, Evidence Vault items with signed timestamps, policy templates with attestation tracking, and a Trust Center page you can share with buyers on demand. You don't have to build a compliance system from scratch — you configure one that already knows the DORA shape.
How the ESAs will supervise critical ICT providers
The largest cloud and IT providers to EU finance get direct EU oversight for the first time.
The designation process
The ESAs designate providers as 'Critical ICT Third-Party Providers' (CTPPs) based on systemic importance to the financial sector. The first list is expected in 2025–26.
What CTPPs face
Direct EU supervision, on-site inspections, mandatory recommendations, and — as ultimate sanction — an EU-level prohibition on providing services to EU financial entities.
Impact on you as a customer
Your CTPP supplier gains regulatory obligations that flow into your contracts. Expect updated DPAs, transparency reports and stronger inspection cooperation.
Concentration risk
If your competitors and you all rely on the same CTPP, that's systemic risk. Your DORA framework must acknowledge this and plan for it.
How ISO-STANDARD.app helps with DORA
Inside the workspace, this topic maps to concrete artefacts: pre-loaded DORA controls with crosswalks to ISO 27001, Evidence Vault items with signed timestamps, policy templates with attestation tracking, and a Trust Center page you can share with buyers on demand. You don't have to build a compliance system from scratch — you configure one that already knows the DORA shape.
DORA exit strategies: what 'good' looks like
An exit strategy is more than a clause — it's a tested, documented plan you could execute in months, not years.
Trigger events
Contract termination, provider failure, regulatory intervention, unacceptable change in service. Your strategy addresses each.
Alternative provider or in-house
You identify at least one credible alternative or an in-house capability. 'No credible alternative' is a red flag your supervisor will want addressed.
Data portability
Contract must give you your data in a usable format on exit, with a defined timescale. Test the export at least annually.
Governance
Board sign-off on exit strategies for critical functions. Not a document the CISO writes alone.
How ISO-STANDARD.app helps with DORA
Inside the workspace, this topic maps to concrete artefacts: pre-loaded DORA controls with crosswalks to ISO 27001, Evidence Vault items with signed timestamps, policy templates with attestation tracking, and a Trust Center page you can share with buyers on demand. You don't have to build a compliance system from scratch — you configure one that already knows the DORA shape.
DORA information sharing: joining the ecosystem
Voluntary today, expected tomorrow. Firms that share intelligence get better intelligence back.
The legal comfort
DORA explicitly permits information sharing arrangements for cyber threats between financial entities, with protections around competition and data protection.
What to share
IOCs, TTPs, thwarted campaigns, sector-specific vulnerabilities. Not attribution — that's for authorities.
ISAC participation
Sector ISACs are the primary vehicle. Membership is often modest cost; participation quality is what determines value.
Governance
Document the arrangement, the scope, the caveats around sharing personal data, and the review cycle. Supervisors will ask about it.
How ISO-STANDARD.app helps with DORA
Inside the workspace, this topic maps to concrete artefacts: pre-loaded DORA controls with crosswalks to ISO 27001, Evidence Vault items with signed timestamps, policy templates with attestation tracking, and a Trust Center page you can share with buyers on demand. You don't have to build a compliance system from scratch — you configure one that already knows the DORA shape.
DORA vs NIS2 for financial entities: which applies?
Financial entities are typically in NIS2 too — but DORA is lex specialis where they overlap.
The principle
Where DORA covers a topic, it takes precedence over NIS2 for financial entities. NIS2 continues to apply where DORA doesn't.
Incident reporting overlap
Financial entities report ICT incidents under DORA, not NIS2. Reporting channels differ — use the DORA one.
Third-party risk
DORA's regime is more prescriptive than NIS2's. Financial firms follow DORA.
Supervision
Financial supervisors (central banks, ESAs) supervise DORA. NIS2 supervisors don't duplicate.
How ISO-STANDARD.app helps with DORA
Inside the workspace, this topic maps to concrete artefacts: pre-loaded DORA controls with crosswalks to ISO 27001, Evidence Vault items with signed timestamps, policy templates with attestation tracking, and a Trust Center page you can share with buyers on demand. You don't have to build a compliance system from scratch — you configure one that already knows the DORA shape.
Starting a DORA programme from zero
A pragmatic sequence if you're behind: register, gap-assess, prioritise, execute, evidence.
Register
Confirm scope. Establish your ICT risk management framework with board approval. Nominate the DORA-responsible executive.
Gap-assess
Against the Level 1 regulation and the ESA technical standards. Score each requirement red/amber/green with an owner.
Prioritise
Third-party register, incident reporting readiness, and board oversight tend to be the fastest to move on and the most visible to supervisors.
Execute
Sprint-plan the remediation. A DORA programme usually runs 12–18 months to steady-state; do the visible work first.
Evidence
Every remediation produces artefacts: policies, tests, reports, contracts. Put them in an Evidence Vault, not a shared drive.
How ISO-STANDARD.app helps with DORA
Inside the workspace, this topic maps to concrete artefacts: pre-loaded DORA controls with crosswalks to ISO 27001, Evidence Vault items with signed timestamps, policy templates with attestation tracking, and a Trust Center page you can share with buyers on demand. You don't have to build a compliance system from scratch — you configure one that already knows the DORA shape.
Ready to evidence DORA?
Load the pre-mapped controls, capture evidence continuously, and publish your DORA posture to buyers on demand.
Prefer a conversation? Email hello@iso-standard.app — a practitioner responds within one business day.