DORA
DORA hub for Regulation (EU) 2022/2554: financial-entity scope, ICT risk management, incident reporting, resilience testing and , ICT third-party risk, registers and oversight.
DORA has applied since 17 January 2025. Start with the Article 2 legal-entity test, then route each in-scope entity into the ICT risk, incident, testing, and third-party work that applies to it.
Check exclusions and the separately. A lighter framework changes some Chapter II duties; it does not make the entity generally exempt from DORA.
DORA's financial-entity duties cover listed categories such as credit institutions, payment and e-money institutions, investment firms, crypto-asset service providers, market infrastructures, insurers, IORPs, credit rating agencies, crowdfunding providers, and securitisation repositories. Specific Article 2 exclusions apply, while Article 16 places certain smaller or sectorally exempt entities under a simplified ICT risk management framework. ICT third-party service providers have a different role: financial entities manage the dependency, while providers designated as critical enter Union-level oversight.
DORA combines management-body governance, a documented ICT risk management framework, identification of ICT-supported functions and assets, incident management and reporting, testing, communication, learning, and continuous improvement.
Financial entities must manage ICT third-party risk as part of ICT risk, maintain a for ICT service contracts, distinguish critical or important functions, assess concentration and subcontracting risk, and keep exit strategies for ICT services supporting critical or important functions.
Check whether the organization is a , an excluded entity, or an ICT third-party service provider that may be relevant through contracts or critical-provider oversight.
Separate governance and ICT risk management from incident reporting, resilience testing, , third-party risk, register-of-information reporting, and oversight of designated critical ICT providers. DORA and its applicable delegated and implementing regulations are binding EU law; voluntary standards and common control frameworks can support evidence, but they do not replace the legal tests.
Connect policies, asset and function inventories, incident records, testing results, attestations, contract clauses, exit plans, LEI/EUID provider identifiers, and register templates to the same operational resilience file.
Track DORA publication, entry into force, the 17 January 2025 application date, Level 2 technical standards, register-of-information templates, incident reporting forms, criteria, and critical ICT third-party provider oversight milestones.
Start by confirming the legal entity, DORA role, exclusions, proportionality and critical functions. Then move to the workstream you own: ICT risk, incidents, testing, third-party dependencies, reporting dates, enforcement or framework overlap.
Name the regulated legal entity and provider relationship, test exclusions and proportionality, and identify the functions whose disruption would materially impair regulated performance or continuity.
Assign control owners, retain records, and document remediation decisions for management-body accountability and the ICT risk framework.
Apply the binding classification thresholds, preserve the decision record, and run the initial, intermediate, and final reporting clocks with the official forms and procedures.
Separate the general risk-based testing programme from threat-led penetration testing for entities identified by competent authorities, then retain scope, test, remediation, and attestation evidence.
Connect critical-function dependencies to due diligence, concentration and subcontracting risk, Article 30 contract rights, exit planning, and the linked register-of-information templates.
Distinguish the Regulation's application date from later Level 2 acts and recurring operating deadlines, then check national enforcement and critical-provider oversight under the applicable penalty rules.
See what DORA changes alongside NIS2, PSD2 reporting, EBA outsourcing guidance, ISO/IEC 27001, and ISO 22301, or use the FAQ for direct scope and implementation answers.
"criteria used for identifying financial entities required to perform threat-led penetration testing"
"within four hours from the classification"
"standard templates for the register of information"
"standard forms, templates, and procedures"
"publish today the list of designated critical ICT third-party providers"
"It shall apply from 17 January 2025."
Next steps
Confirm the entity and function boundary, then assign each DORA workstream and its evidence records to legal, risk, technology, security, procurement, incident response, or resilience-testing owners.
Turn DORA scope, ICT risk, incident reporting, testing, , third-party, register, and oversight work into owned tasks and review checkpoints.
Answer DORA scope, RTS, ITS, reporting, , register, subcontracting, and oversight questions with cited outputs from official sources.
Align DORA application, Level 2 standards, reporting, register, , and oversight milestones.
Review your entity scope, ICT risk framework, incident pathway, provider register, readiness, and evidence model.