Regulation
What is DORA (Digital Operational Resilience Act)?
Also known as: DORA, Regulation (EU) 2022/2554
DORA (Regulation (EU) 2022/2554) is the EU regulation that requires financial entities to manage ICT risk, report major ICT incidents, test their digital operational resilience and control their ICT third-party providers; it has applied since 17 January 2025.
DORA applies to banks, insurers, investment firms, payment and e-money institutions, crypto-asset service providers and other financial entities, and brings critical ICT third-party providers, such as large cloud providers, under direct EU oversight.
Because it is a regulation, DORA applies directly in every member state. Detailed rules are set in regulatory and implementing technical standards, for example on the ICT risk-management framework, incident classification and the register of information.
The five pillars
- ICT risk management
- ICT-related incident management, classification and reporting
- Digital operational resilience testing, including threat-led penetration testing for significant entities
- ICT third-party risk management and the register of information
- Information and intelligence sharing
How Clateway helps
- DORA compliance for financial entities – DORA compliance for financial entities: ICT risk management framework, register of information on ICT third parties, incident management and resilience testing evidence.
- Vendor and third-party risk management – Third-party risk management: vendor registry, risk scoring, breach history, adverse media monitoring, fourth parties, contract lifecycle and renewal alerts.
- IT incident management and service desk – Incident management and service requests with priority matrix, SLAs on business hours, major incidents, a self-service portal and two-way ServiceNow sync.