Question 1

What is DORA regulation?

Accepted Answer

The Digital Operational Resilience Act (DORA) is an EU regulation that establishes a comprehensive framework for managing ICT (Information and Communication Technology) risks in the financial sector. It applies to financial entities and ICT third-party service providers across the European Union, ensuring they can withstand, respond to, and recover from ICT-related disruptions.

Question 2

When did DORA enter into application?

Accepted Answer

DORA officially entered into full application on January 17, 2025. Financial entities are required to be fully compliant with all DORA requirements from this date. The regulation initially entered into force on January 16, 2023, providing a two-year transition period.

Question 3

Who needs to comply with DORA?

Accepted Answer

DORA applies to over 22,000 financial entities and ICT service providers in the EU, including: banks, payment institutions, insurance companies, investment firms, crypto-asset service providers, credit rating agencies, and critical ICT third-party service providers serving these entities.

Question 4

What are the 5 pillars of DORA?

Accepted Answer

DORA is built on five key pillars: (1) ICT Risk Management - comprehensive framework for identifying and managing ICT risks, (2) Incident Reporting - mandatory reporting of major ICT-related incidents, (3) Digital Operational Resilience Testing - regular testing including threat-led penetration testing (TLPT), (4) Third-Party Risk Management - oversight of ICT service providers, (5) Information Sharing - arrangements for exchanging cyber threat intelligence.

Question 5

What are RTS and ITS under DORA?

Accepted Answer

RTS (Regulatory Technical Standards) and ITS (Implementing Technical Standards) are detailed rules developed by ESAs (European Supervisory Authorities - EBA, EIOPA, ESMA) to specify how DORA requirements should be implemented. They cover areas like ICT risk management frameworks, incident reporting procedures, and resilience testing methodologies.

Question 6

What are the reporting timelines for major incidents?

Accepted Answer

Under DORA, major ICT-related incidents must be reported following strict timelines: Initial notification within 4 hours after classification, Intermediate report within 72 hours of detection, and Final report within 1 month of detection. These timelines are aligned with NIS2 Directive requirements.

Question 7

How do I implement an ICT risk management framework?

Accepted Answer

Implementing a DORA-compliant ICT risk management framework involves: (1) Establishing governance structures with clear roles and responsibilities, (2) Identifying and documenting all ICT systems supporting business functions, (3) Conducting regular risk assessments, (4) Implementing appropriate controls and safeguards, (5) Maintaining a business continuity policy, (6) Regular monitoring and testing, (7) Documenting all processes and maintaining registers.

Question 8

What is TLPT (Threat-Led Penetration Testing)?

Accepted Answer

TLPT is an advanced form of security testing required under DORA for larger financial entities. It simulates real-world cyberattacks using intelligence about actual threats targeting the financial sector. DORA mandates TLPT at least every three years, following the TIBER-EU framework developed by the European Central Bank.

Question 9

What are critical ICT third-party service providers?

Accepted Answer

Critical ICT third-party service providers (CTPPs) are ICT service providers designated by ESAs as critical based on their systemic importance to the financial sector. CTPPs face direct oversight by ESAs and must meet enhanced requirements regarding risk management, resilience, and reporting.

Question 10

Do I need to maintain registers of information?

Accepted Answer

Yes, financial entities must maintain and update comprehensive registers of information containing all contractual arrangements with ICT third-party service providers. These registers must be available at entity level and consolidated group level, and competent authorities must report them to the Lead Overseer by April 30, 2025.

Question 11

What constitutes a major incident under DORA?

Accepted Answer

A major ICT-related incident is classified based on criteria including: impact on financial stability, number of clients affected, duration of service disruption, geographical spread, data losses, criticality of services affected, and economic impact. Specific classification criteria are detailed in the ITS on major incident reporting.

Question 12

How should I prepare for DORA compliance?

Accepted Answer

Key preparation steps: (1) Conduct a gap analysis against DORA requirements, (2) Establish ICT risk management governance, (3) Create comprehensive ICT asset inventory, (4) Review and update contracts with ICT service providers, (5) Implement incident detection and response capabilities, (6) Develop resilience testing programs, (7) Establish reporting procedures, (8) Train staff on DORA requirements.

Question 13

Are there simplified requirements for smaller entities?

Accepted Answer

Yes, DORA provides for simplified ICT risk management frameworks for microenterprises and small and non-interconnected investment firms. These entities can implement proportionate measures while still meeting core resilience objectives. However, the principle of proportionality applies to all entities based on their size, complexity, and risk profile.

Question 14

What are the penalties for non-compliance?

Accepted Answer

DORA empowers competent authorities to impose administrative pecuniary sanctions on entities for violations. Maximum penalties can reach €10 million or 5% of annual turnover (whichever is higher) for legal persons, and €5 million for natural persons. Additional measures include public warnings, temporary bans, and withdrawal of authorization.

Question 15

What is the role of ESAs under DORA?

Accepted Answer

The European Supervisory Authorities (EBA for banking, EIOPA for insurance, ESMA for securities) jointly develop technical standards, issue guidelines, and coordinate oversight of critical ICT third-party service providers. They also facilitate information sharing and cooperation among national competent authorities.

Core Pillars

Need Help with Compliance?

❓ DORA Regulation FAQ

🚀 Ready to Get Started with DORA Compliance?