What Is DORA? Digital Operational Resilience Act Explained

Why DORA Exists

Financial services depend on ICT and critical suppliers. DORA harmonises operational-resilience rules across the Union so supervisors can expect comparable ICT governance, major-incident reporting, testing, and third-party oversight — without relying only on fragmented national ICT circulars.

The Five Pillars (Map)

1. ICT risk management — Articles 5–16 themes (governance through learning and evolution)
2. Incident management & reporting — classification and major-incident notifications
3. Digital operational resilience testing — including TLPT for significant entities
4. ICT third-party risk — register of information, contractual keys, CTPP oversight
5. Information sharing — voluntary cyber-threat intelligence arrangements

Deep dive: The 5 pillars of DORA explained.

DORA vs NIS2

DORA is a sectoral regulation for financial entities and their ICT providers. NIS2 is a horizontal cybersecurity directive for essential/important entities. Many banks sit under both conversations — see NIS2 vs DORA.

Where Programmes Usually Start

• Confirm Article 2 scope — applicability guide
• Stand up the ICT risk framework and register of information
• Wire detection to major-incident clocks — deadlines
• Use a working checklist — DORA checklist

How CyberSilo Helps

• Pillar-by-pillar evidence maps in CSA for DORA
• Detection and major-incident timelines with ThreatHawk SIEM
• Advisory scoping — contact CyberSilo

Frequently Asked Questions

Is DORA a directive or a regulation?

DORA is Regulation (EU) 2022/2554 — directly applicable across EU Member States without national transposition of the core text (RTS/ITS and national supervisory practice still matter).

When did DORA start applying?

DORA became applicable on 17 January 2025.

Does ISO 27001 replace DORA?

No. ISO 27001 helps evidencing ICT controls but does not replace DORA’s incident clocks, TLPT rules, register of information, or CTPP oversight — see DORA vs ISO 27001.

Related DORA Resources

Hub · ICT risk (Arts 5–16) · RTS / ITS list · CSA