Operational resilience for insurers, reinsurers, IORPs and intermediaries: scope and exclusions, Solvency II integration, claims & underwriting resilience, third-party rules, TLPT scope.
A practitioner-built DORA compliance pack for insurance and reinsurance undertakings and intermediaries: a 30-point Excel checklist across the five pillars plus an implementation guide (PDF) mapped to the Solvency II system of governance and IDD, with proportionality built in.
+ VAT. Instant download (Excel + PDF). One-time purchase, no subscription.
Building your DORA team? Insurers hire the DORA Compliance Officer first, a verifiable certification for exactly the profile supervisors and hiring teams look for. Browse all DORA certifications.
The insurance sector is structurally different from banking when it comes to operational resilience, but the regulatory exposure is just as significant. Insurance carriers run long-tail data (life policies sold today create obligations 30-50 years out) on technology stacks that frequently combine 1980s mainframes (still alive in many insurers), 2000s policy administration systems, modern actuarial cloud workloads, and customer-facing digital channels built in the past five years. This patchwork creates an unusual operational risk surface: legacy data dependencies, complex integration layers, and digital interfaces all needing simultaneous resilience.
Beyond technology, insurers carry highly sensitive personal data: policyholder identities, beneficiaries, health information for life and health business, accident records, financial details, and behavioural data from telematics or smart-home sensors. A material data breach or processing outage in an insurer hits regulators (DORA + GDPR + national supervisors), customers (loss of trust, claims delays), and the broader market (reputational contagion).
DORA brings this entire risk surface under harmonised supervision. National competent authorities (BaFin, ACPR, IVASS, DNB, MFSA, FSC, etc.) supervise compliance: the authority designated under Solvency II Article 30 for undertakings and under IDD Article 12 for intermediaries (DORA Article 46(k) and (l)). EIOPA, as one of the three European Supervisory Authorities, co-develops the technical standards, receives details of major ICT-related incidents (Article 19(6)) and can be Lead Overseer of a critical ICT third-party service provider (Article 31(1)(b)). The framework explicitly recognises Solvency II as the prudential foundation but adds binding ICT-specific obligations that go beyond what Solvency II Pillar 2 alone delivers.
DORA applies to a broad set of insurance-sector entities, with proportionality calibrating the depth of obligations. The main scope categories:
Authorised under Solvency II (Directive 2009/138/EC). Full DORA scope, without access to the simplified framework of Article 16, unless referred to in Article 4 of Solvency II (Article 2(3)(b)). A microenterprise stays in scope, relieved of specific requirements only. Includes life, non-life, composite and pure reinsurers.
Authorised under the IDD. Only intermediaries above the medium-sized enterprise limits are in scope: micro, small and medium-sized intermediaries are excluded (Article 2(3)(e)). No simplified framework: Article 16 is not open to intermediaries.
IORPs authorised or registered under the IORP II Directive. Excluded where their schemes together have no more than 15 members (Article 2(3)(c)); the simplified framework of Article 16 applies to small IORPs, below 100 members (Article 3(53)); the full framework applies from 100 members.
PEPP providers are not a category of DORA Article 2(1). DORA reaches them through their own authorisation, for example as a credit institution, life insurer, IORP, investment firm, UCITS management company or AIFM (Regulation (EU) 2019/1238, Article 6(1)).
Which kind of insurance-sector entity are you?
Insurance and reinsurance undertakings are listed in Article 2(1)(n) and are not on the closed list of Article 16, whatever their size. Articles 5 to 15 apply, calibrated by Article 4; a microenterprise is relieved of specific requirements only, such as the internal audit of the framework (Article 6(6)). TLPT applies only if your competent authority identifies you (Article 26(8)).
Next step: DORA Gap AnalysisDORA does not apply to insurance and reinsurance undertakings referred to in Article 4 of Solvency II (Directive 2009/138/EC). Keep the status under review: an undertaking that Article 4 no longer covers is in scope under Article 2(1)(n), with the full framework of Articles 5 to 15.
Next step: DORA Scope DeterminationDORA does not apply to insurance, reinsurance and ancillary insurance intermediaries which are microenterprises or small or medium-sized enterprises. The upper bound is Article 3(64): fewer than 250 persons, with annual turnover not above EUR 50 million and/or annual balance sheet not above EUR 43 million. Keep your size under review.
Next step: DORA Scope DeterminationAn insurance, reinsurance or ancillary insurance intermediary that is not a micro, small or medium-sized enterprise is in scope under Article 2(1)(o). Article 16 is not open to intermediaries, so Articles 5 to 15 apply, calibrated by Article 4. Using ICT third-party service providers leaves you fully responsible for compliance (Article 28(1)(a)).
Next step: DORA Compliance ChecklistNot sure your entity is a financial entity at all? Run the free scope determination.
For insurers, the most important regulatory question after "what does DORA require" is "what changes versus what we already do under Solvency II?" The answer matters because Solvency II is the prudential pillar of EU insurance regulation; DORA is operational resilience built on top of it.
The Own Risk and Solvency Assessment (ORSA) is the centrepiece of Solvency II Pillar 2. Integrating DORA-aligned ICT risk into the ORSA keeps one risk picture across both regimes. Practically this means: ICT risk scenarios in ORSA stress tests, ICT capital quantification methodology, ICT risk appetite alignment with overall risk appetite, and explicit linkage between DORA register of information and ORSA outsourcing risk assessment.
The systems that matter most under DORA at insurers reflect the operational reality of insurance: long policy lifecycles, complex calculation engines, cross-jurisdictional data flows.
Manage policy lifecycle (new business, renewals, endorsements, cancellations, lapse). Frequently legacy COBOL/PL1 platforms with 30+ year history. Replacement programmes are multi-year: meanwhile, Article 8(7) requires a specific ICT risk assessment of legacy ICT systems at least yearly.
Submission, triage, assessment, settlement and payment. Customer-facing in case of digital first notice of loss. Recovery time and recovery point objectives should follow from the business impact analysis (Article 11(5)).
Risk scoring, pricing, quote generation. Increasingly ML-driven with cloud workloads. Within TLPT scope where it supports a critical or important function of an insurer identified for TLPT (Article 26(2)).
Reserving, IFRS 17 calculations, Solvency Capital Requirement model. Often a mix of vendor solutions (Prophet, AXIS, Moses) and bespoke spreadsheet/Python layers. Material data integrity risk if controls are weak.
Digital channels for policy management, claims submission, document upload. High availability requirements; identity and authentication a primary DORA control area.
Treaty management, ceded claims tracking, recoveries. Often shared infrastructure with reinsurers: creates joint third-party risk profile.
Connected-car, smart-home and wearable data feeds for behavioural pricing. Massive volume, real-time, often in cloud: high in concentration risk assessments.
Claims fraud screening using rule engines and ML. Failures expose insurer to financial loss; data quality and model robustness in scope of DORA testing.
Insurers must maintain a board-approved ICT risk management framework integrated with Solvency II governance. The framework must address all critical insurance systems (above), define risk appetite for ICT risk, and provide independent ICT risk function visibility. The RTS on ICT risk framework (Commission Delegated Regulation 2024/1774) specifies minimum content for security policies, encryption, identity management, network segmentation, change management and ICT business continuity.
Standardised classification under the RTS on classification, with insurer-specific application: claims processing impact, policy administration outage, fraud detection failure, actuarial system compromise. Same 4h / 72h / 1-month workflow as banking. Reports go to your competent authority on the harmonised templates of Implementing Regulation (EU) 2025/302, common to all financial entities.
Appropriate tests of all ICT systems and applications supporting critical or important functions at least yearly (Article 24(6)), drawn from vulnerability assessments, penetration tests, scenario-based tests and the other tests of Article 25. Insurers identified by their competent authority also conduct TLPT at least every 3 years (see below).
The Register of Information for insurers must capture not just hyperscaler relationships but also: policy administration vendors (Sapiens, Guidewire, Insurity, Duck Creek), actuarial platforms (FIS Prophet, Milliman AXIS, Moody's AXIS), claims technology (CoreLogic, Mitchell, Solera), reinsurance platforms, fraud detection (Shift Technology, FRISS), and underwriting workbenches.
Voluntary participation in cyber threat sharing, within trusted communities of financial entities and under arrangements that protect the information shared (Article 45(1)). Notify your competent authority when you join or leave an arrangement (Article 45(3)).
8 questions drawn from the requirements above. Each gap you declare comes back with the course that covers it and the tool that does the work. Your answers stay in this browser.
Has your management body approved an ICT risk management framework under Articles 5 to 15, with its Article 4 calibration documented and, for an undertaking, built into the Solvency II system of governance and the ORSA?
Are policy administration, claims, underwriting and actuarial systems mapped as supporting critical or important functions, with a business impact analysis setting RTO and RPO and recovery tests run against them?
Have you pre-defined which outages of policy, claims or pricing systems, and which breaches of policyholder or health data, would meet the major-incident criteria of Delegated Regulation (EU) 2024/1772?
Can a named team classify an incident on your own or an outsourced platform and file the initial notification to your competent authority within 4 hours of classifying it as major, with templates ready?
Are the ICT services behind policy administration, claims, actuarial models and reinsurance platforms, cloud included, recorded in your Register of Information, at entity level and, for a group, at sub-consolidated and consolidated level?
Do your contracts with policy-administration, claims and actuarial platform providers contain the Article 30 clauses, with a tested exit plan for each ICT service supporting a critical or important function and, for an undertaking, alignment with Solvency II Article 49?
Do you test the ICT systems supporting critical or important functions, policy, claims and actuarial systems included, at least yearly under a risk-based programme, and have you recorded whether your competent authority has identified you for TLPT?
Does your management body follow specific ICT risk training on a regular basis, and do all staff, including those who oversee outsourced platforms, complete digital operational resilience training (Articles 5(4) and 13(6))?
You declared 0 areas to work on, gaps first. Each one names what to learn and what to use.
Indicative self-assessment based on your own answers, not a compliance opinion. Prices exclude VAT.
Your score and your priorities, each with the course and the tool that cover it. The newsletter only if you tick the box.
TLPT under Article 26 reaches the insurance sector. Competent authorities identify the financial entities that must perform it (Article 26(8)), or the single TLPT authority does so where a Member State has designated one (Article 26(9)), based on:
Unlike banking where critical functions cluster around payments, trading and core banking, insurance TLPT must address a more dispersed surface. Common in-scope objectives include: simulated unauthorised access to policyholder PII at scale, fraudulent claim approval through workflow manipulation, actuarial data tampering affecting reserves, and ransomware-style impact on policy administration. Each test covers several or all critical or important functions on live production systems, and the competent authority validates the scope (Article 26(2)).
Insurance has a particularly long tail of specialised ICT providers, each with sector-specific functionality, and every contractual arrangement on ICT services belongs in the Register of Information (Article 28(3)).
The classification criteria (RTS on classification) apply identically across financial entities, but the manifestations are sector-specific. Incidents to test against them at insurers, each major only where critical services are affected and either successful malicious unauthorised access or two other materiality thresholds are met (Delegated Regulation (EU) 2024/1772, Article 8):
Same harmonised template as banking. Submitted through the national supervisor portal, for most insurers this is the supervisor that authorises them under Solvency II. Cross-border groups submit at solo level to each home authority.
Within 4 hours of classifying the incident as major, and no later than 24 hours after becoming aware of it.
Enter the classification timeWithin 72 hours of submitting the initial notification, and updated when the situation changes.
Follows the initial notificationWithin one month of the latest intermediate report, once the root cause analysis is complete.
Follows the intermediate reportDelegated Regulation (EU) 2025/301, Article 5; classification under Delegated Regulation (EU) 2024/1772. The later deadlines assume each report goes in at its latest permissible time. A deadline falling on a weekend or bank holiday moves to noon of the next working day (Article 5(4)), except for the initial notification and intermediate report of credit institutions, central counterparties, operators of trading venues and essential or important entities under NIS2, or where your competent authority has decided otherwise (Article 5(5) and (6)); the dates shown do not apply that extension.
Map all in-scope entities (carrier, brokerage, IORP), apply proportionality test, run gap analysis against DORA + RTS pack. Output: prioritised remediation backlog.
Update ICT risk appetite, define DORA function vs Solvency II risk function model, refresh board ICT competence. Update ORSA template to integrate ICT risk.
ICT risk policy, BCP/DRP, third-party policy, incident management policy, testing policy: all aligned with RTS pack and EIOPA expectations.
Inventory all ICT contracts including specialised insurance vendors. Capture sub-outsourcing chains down to Tier 3+. Validate LEIs. Build data quality controls. Submit on the date your competent authority sets, in the format of Implementing Regulation (EU) 2024/2956.
Article 30 mandatory clauses. Priority: policy admin vendor, actuarial platform, hyperscaler, claims TPA. Specialised insurance vendors often slower to provide DORA addendums.
Tabletop exercises focused on insurance-specific scenarios: catastrophe-event claims surge with system outage, ransomware on policy admin, identity compromise on agent portals.
Annual testing programme launched. ORSA cycle integrates ICT risk under DORA terminology. TLPT procurement initiated for designated insurers.
Continuous register update, quarterly board reporting, integration with annual ORSA cycle, supervisory dialogue with home NCA.
Our specialised team understands insurance operations and helps insurers implement DORA efficiently.
In an insurer, a few roles carry DORA decisions. The incident team judges whether a claims-platform outage or a policyholder data breach is a major incident: the initial notification is due within 4 hours of classifying it as major. Whoever manages outsourcing negotiates Article 30 clauses with hard-to-replace platform providers and keeps the Register of Information consistent across the group. The risk management function brings ICT risk into the ORSA. The management body approves the framework and keeps its ICT risk knowledge current. Each needs to know what DORA expects of the role.
Members of the management body must “actively keep up to date with sufficient knowledge and skills” to understand and assess ICT risk, including by following specific training on a regular basis.
Regulation (EU) 2022/2554, on EUR-Lex Article 13(6) · All staffICT security awareness programmes and digital operational resilience training are “compulsory modules” of staff training, for all employees and senior management, at a level that matches each function.
Regulation (EU) 2022/2554, on EUR-LexOwns the DORA programme, the scope decision under Article 2(3), the record that Article 16 is not available and the evidence file your competent authority will ask for.
The first lesson is open to read before you buy.
Coordinates the ICT risk control function (Article 6(4)) with the Solvency II risk management function, brings ICT risk into the ORSA and documents the Article 4 calibration.
The first lesson is open to read before you buy.
Classifies outages of policy, claims and underwriting platforms and breaches of policyholder data against Delegated Regulation (EU) 2024/1772, and drafts the initial, intermediate and final reports.
The first lesson is open to read before you buy.
Oversees policy-administration, claims, actuarial and cloud providers: Register of Information across the group, Article 30 clauses, concentration and exit plans, aligned with Solvency II Article 49.
The first lesson is open to read before you buy.
Bears ultimate responsibility for ICT risk, approves the framework and the policy on ICT third-party services, and keeps its ICT risk knowledge current through specific training (Articles 5(2) and 5(4)).
The first lesson is open to read before you buy.
For insurers & intermediaries: compliance, ICT risk, incident reporting and third-party oversight, tuned to the insurance operating model.
Several people to train? Team seats cost less per learner from 2 seats, on one invoice: see team pricing.
Starting out? DORA Fundamentals is free, certificate included.
The tools that matter most for your sector, and what each one does for you.
Enter the ICT services behind policy administration, claims, actuarial models and reinsurance platforms in the ITS templates and run the validation rules before you report.
Open €149Set MTPD, RTO and RPO for policy administration, claims, underwriting and actuarial systems, and record which functions are critical or important.
Open FreeTest a past claims-platform outage or policyholder data breach against the major-incident criteria of Delegated Regulation (EU) 2024/1772.
Open Initial report free · full drafts €99Draft the initial notification for a policy or claims platform outage, with each reporting deadline computed.
Open FreeScore policy-administration, actuarial and cloud providers and see which ones need an exit plan first.
Open €149Plan the Article 11(6) tests of your ICT business continuity and crisis communication plans around a claims-platform outage during a catastrophe event.
OpenAll tools: browse the full list. Prices exclude VAT.
How DORA compliance affects cyber insurance pricing.
Banking vs Insurance: DORA DifferencesSector-specific differences explained.
Cloud Services Under DORAAWS, Azure, GCP under DORA.
Third-Party ICT Risk ManagementRegister of Information & Article 30.
Third-Party Risk ScorerFree interactive tool.
DORA Gap Analysis Tool15-minute compliance check.
DORA Audit GuideSupervisory inspections, internal audit duties & readiness.
DORA vs NIS2Lex specialis & dual compliance.
TLPT Methodology5-phase testing methodology.
DORA for Insurance Teams: certify your teamFour role certifications tuned for insurers. One person or a team licence.
The free Gap Analysis asks 16 questions across all five DORA pillars, about ten minutes of work, and returns your score, your prioritised gaps and a remediation roadmap. No signup.
Run the free Gap AnalysisActuarial and underwriting models that price life or health cover are named in Annex III. Claims-handling automation generally is not: the line runs through pricing and risk evaluation.
Once your gap analysis is done, the real work begins: maintaining evidence, tracking incidents, submitting the register of information every year, managing vendor contracts. Resiplan runs all five DORA pillars in one platform designed for insurers, no more dozens of spreadsheets or a dedicated team to keep them in sync. Advising several institutions? Each client gets its own separate tenant.
Workbooks, playbooks and certifications built for EU financial entities. Add several to your cart: volume discounts apply automatically.
Take our free 5-minute assessment and get an instant DORA compliance score with personalised recommendations.