EU
DORA
Digital Operational Resilience Act (EU) 2022/2554
2022/2554
17 controls · 5 domains
Mandatory for: Mandatory for EU financial entities and critical ICT providers
About this framework
The Digital Operational Resilience Act is an EU regulation that makes financial firms strengthen their resilience to IT disruption. It covers risk management, incident reporting, resilience testing, and oversight of technology suppliers.
Who needs this
Mandatory for EU banks, insurers, investment firms, and their critical technology providers.
Cross-framework coverage
Controls in DORA also cover:
NCA ECC-2 10 shared
NCA OTCC 10 shared
UAE IA 10 shared
CJIS 9 shared
ADHICS 9 shared
See how DORA connects to the rest → the Security Universe
Control domains
P1 · ICT Risk Management 7
ART.5
ICT risk-management framework governance
Management body owns and approves the ICT risk-management framework; clear roles and accountability.
ART.6
ICT risk-management framework
Documented framework: strategies, policies, tools and procedures to protect ICT assets.
ART.8
Identification
Identify, classify and document ICT-supported business functions, assets and dependencies.
ART.9
Protection and prevention
Security policies, controls and tools to ensure resilience, continuity and availability of ICT systems.
ART.10
Detection
Mechanisms to promptly detect anomalous activities and ICT-related incidents.
ART.11
Response and recovery
ICT business-continuity policy, response and recovery plans, regularly tested.
ART.13
Learning and evolving
Capabilities to gather information on vulnerabilities and incidents and to learn from them.
P2 · ICT Incident Management & Reporting 3
ART.17
ICT-related incident management process
Process to detect, manage and notify ICT-related incidents and log all incidents.
ART.18
Classification of incidents
Classify incidents and cyber threats by criteria (clients affected, duration, data losses, criticality).
ART.19
Reporting of major incidents
Report major ICT-related incidents to the competent authority within defined timeframes.
P3 · Digital Operational Resilience Testing 3
ART.24
Resilience testing programme
Establish a sound, comprehensive, risk-based digital operational resilience testing programme.
ART.25
Testing of ICT tools and systems
Tests such as vulnerability assessments, scans, gap analyses and penetration tests, at least yearly.
ART.26
Threat-led penetration testing (TLPT)
Advanced TLPT for significant entities at least every three years.
P4 · ICT Third-Party Risk 3
ART.28
General principles — third-party risk
Manage ICT third-party risk as an integral part of the ICT risk-management framework.
ART.29
Concentration risk
Assess ICT concentration risk when contracting critical or important functions.
ART.30
Key contractual provisions
Contracts with ICT providers contain mandatory key provisions (access, audit, exit, sub-outsourcing).
P5 · Information Sharing 1
ART.45
Cyber-threat information-sharing arrangements
Exchange cyber-threat information and intelligence within trusted communities, protecting confidentiality.
Ready to assess against DORA?
Start free trial →