DORA and ISO 27001 share the same engine: a risk-based, management-led control system. The Lead Implementer’s craft is to run one integrated system that satisfies both — not two that compete.

The thesis

A certified ISMS already delivers most of DORA Pillar 1 and parts of 2–4. Implementing DORA then becomes: re-scope the ISMS to critical functions, map Annex A to the pillars, and build the regulatory delta as additional ISMS scope. Faster, cheaper, auditable.

Two frameworks, one management system

The Digital Operational Resilience Act (Regulation (EU) 2022/2554) has applied to in-scope financial entities since 17 January 2025. ISO/IEC 27001:2022 is the international standard for an information security management system (ISMS). They differ in status — one is binding EU law, the other a voluntary certifiable standard — but both rest on the same Plan-Do-Check-Act loop: leadership sets direction, risk is assessed and treated, controls operate, and audit and review drive improvement. That shared architecture is why an ISMS is the ideal chassis on which to mount DORA, rather than a rival to it. The RTS on ICT risk management (Reg (EU) 2024/1774) reads, in large part, like a security-control baseline an ISO practitioner already recognises.

Worked example. A mid-size German investment firm already holds an ISO 27001:2022 certificate. Rather than launch a separate “DORA project”, its Lead Implementer re-scopes the ISMS around the trading and settlement functions, maps Annex A to the five DORA pillars, and lists the handful of genuinely new duties (incident reporting, the Register, TLPT). Six weeks later the firm evidences DORA from the same management system it already runs — at a fraction of a greenfield programme’s cost.