| Scope boundary | DORA targets digital operational resilience in the financial sector. Its scope is tied to financial entities, ICT risk, ICT-supported functions, major ICT-related incidents, resilience testing, and ICT third-party services. | ISO 22301 targets business continuity management systems. Its scope is set by the organization and covers the management system used to prepare for, respond to, and recover from disruptive incidents. | An ISO 22301 BCMS can support DORA continuity evidence, but it does not decide whether a financial entity is in DORA scope or whether a DORA ICT obligation applies. |
|---|
| Covered actors | DORA work includes ICT risk governance, ICT-related incident management and classification, operational resilience testing, ICT third-party risk management, register-of-information maintenance, and management accountability. | ISO 22301 work includes BCMS context and scope, leadership, policy, objectives, resources, documented information, BIA and risk assessment, continuity strategies, plans, exercises, internal audit, management review, and improvement. | Map controls at the requirement level. A continuity plan is useful for both, but DORA also needs ICT-specific governance, incident, testing, provider, and register evidence. |
|---|
| Trigger | DORA focuses on ICT-related incidents, including classification of major incidents and cyber threats under DORA technical standards. | ISO 22301 focuses on disruptive incidents through continuity response, warning and communication, business continuity plans, recovery, exercises, evaluation, and improvement. | A major ICT-related incident record should include DORA classification and reporting evidence. The same event may also create ISO 22301 evidence for plan activation, recovery performance, lessons learned, and corrective action. |
|---|
| Core obligations | DORA requires digital operational resilience testing and includes a specific threat-led penetration testing track for financial entities that meet the applicable criteria. | ISO 22301 requires an exercise programme and evaluation of business continuity documentation and capabilities as part of the BCMS. | Use ISO 22301 exercises for continuity capability, but do not treat them as DORA TLPT or ICT resilience testing unless the DORA criteria, scope, evidence, and governance are also met. |
|---|
| Evidence record | DORA evidence should show ICT risk decisions, incident classification, testing scope and results, ICT service registers, third-party contract controls, remediation, and management oversight. | ISO 22301 evidence should show the BCMS scope, policy, objectives, BIA, risk assessment, continuity strategies, plans, exercises, internal audits, management reviews, and improvement actions. | Build one evidence index with two labels per record: the DORA obligation supported and the ISO 22301 BCMS requirement supported. Leave blanks where a record supports only one side. |
|---|
| Supplier and third-party risk | DORA treats ICT third-party risk as a dedicated obligation, including policies for ICT services supporting critical or important functions and register evidence for ICT service arrangements. | ISO 22301 treats suppliers through continuity dependencies, interested-party needs, resource requirements, continuity strategies, and documented continuity arrangements. | Supplier continuity assessments can be reused, but DORA needs ICT-provider classification, critical or important function linkage, contractual evidence, subcontracting awareness where relevant, and register-ready data. |
|---|
| Enforcement | DORA assurance is supervisory and legal. Covered entities need evidence that can be reviewed through financial-sector governance and supervisory channels. | ISO 22301 assurance is management-system assurance. Organizations can use internal audits, management review, and external certification or customer assurance where that is part of their assurance model. | ISO 22301 certification may help demonstrate continuity discipline, but it is not a DORA certificate and should not be presented as proof that DORA obligations are complete. |
|---|
| Overlap and reuse | Use DORA when the question is whether a financial entity has met ICT operational resilience, incident, testing, ICT third-party, register, or supervisory evidence duties. | Use ISO 22301 when the question is whether the organization has a functioning BCMS for disruption preparedness, continuity response, recovery, exercise, audit, review, and improvement. | For every shared control, write the DORA purpose and ISO 22301 purpose separately. If you cannot name both, the control is probably reusable evidence for only one side. |
|---|
| Practical decision rule | DORA targets digital operational resilience in the financial sector. Its scope is tied to financial entities, ICT risk, ICT-supported functions, major ICT-related incidents, resilience testing, and ICT third-party services. | ISO 22301 targets business continuity management systems. Its scope is set by the organization and covers the management system used to prepare for, respond to, and recover from disruptive incidents. | An ISO 22301 BCMS can support DORA continuity evidence, but it does not decide whether a financial entity is in DORA scope or whether a DORA ICT obligation applies. |
|---|