DORA compliance

DORA applies since 17 January 2025 to banks, payment and e-money institutions, investment firms, insurers, crypto-asset service providers and other financial entities. It reaches the ICT providers that serve them as well: their contracts must carry DORA's terms, and the most critical providers are overseen by EU supervisors.

  • Digital Operational Resilience Act
  • 2022/2554
  • Requirements in the catalogue: 30
  • Official text

What it requires

The main obligations in plain words, with the article or clause they come from.

  • Art. 5–16

    Run an ICT risk-management framework that the management body approves and oversees: identification, protection, detection, response and recovery, backup, learning and communication.

  • Art. 17–19

    Classify ICT-related incidents and report the major ones: an initial notification, an intermediate report and a final report.

  • Art. 24–27

    Test digital operational resilience every year; some entities also run threat-led penetration testing every three years.

  • Art. 28(3)

    Keep a register of information on all contractual arrangements with ICT third-party providers.

  • Art. 28–30

    Assess providers before contracting, put the key contractual provisions in place, and have exit strategies for critical or important functions.

How Atitic covers it

What the product does for this framework, on the same records as every other.

  • The ICT register holds the register of information: providers, the functions they support, criticality, exit strategy, the sub-contractor chain and contractual safeguards.

  • Each major incident shows its DORA deadlines: the initial notification within 4 hours of classification and no later than 24 hours after awareness, the intermediate report within 72 hours, and the final report within one month.

  • The yearly review of the ICT risk-management framework, the register of information update, backup restore and continuity tests, incident exercises and threat-led penetration test planning sit in the governance calendar, with owners and reminders.

  • The ISO 27001 crosswalk counts an existing management system toward the ICT risk-management framework; Fasttrack recognizes financial entities and their ICT providers.

What the catalogue holds

The areas of the framework in Atitic and how many requirements each holds. When you adopt it, each requirement becomes a row you own and link to policies, evidence and controls.

  • ICT risk-management framework11
  • ICT-related incident management, classification and reporting7
  • Digital operational resilience testing4
  • ICT third-party risk management7
  • Information-sharing arrangements1

Related frameworks: ISO 27001 MiCA ISAE 3402

Free self-check

Answer a short questionnaire and get an indicative readiness score and the gaps that matter most, by email.

Take the self-check

Common questions

We are an ICT provider, not a bank. Does DORA apply to us?

Not directly, unless you are designated as a critical ICT third-party provider. Your financial customers must still put DORA's contract terms in place with you, monitor you and plan an exit, so they will ask you for evidence. An ISAE 3402 report or an ISO 27001 certificate answers much of it.

What is the register of information?

A record of every contractual arrangement for ICT services, kept at entity level and, for groups, at consolidated level, which financial entities must make available to their supervisor on request.

Is there a lighter regime for smaller financial entities?

Yes. Some, such as small and non-interconnected investment firms and certain exempted payment and e-money institutions, may apply the simplified ICT risk-management framework of Art. 16.

A summary for orientation, not legal advice. The official text is the reference.

Try it on your own data

Adopt DORA in a free trial, link the evidence you already have and see what is still missing.

Start a free trial