DORA Compliance: What Financial Entities Need to Know

The Digital Operational Resilience Act (DORA) became applicable on 17 January 2025, marking a fundamental shift in how EU financial entities manage ICT risk. If you operate in banking, insurance, investment, or crypto-asset services within the EU, DORA applies to you.

What is DORA?

DORA establishes uniform requirements for the security of network and information systems across the financial sector. Unlike previous directives, DORA is a regulation — it applies directly without national transposition, creating a level playing field across all EU member states.

The 5 Pillars

Pillar 1: ICT Risk Management (Articles 5-16)

Financial entities must establish a comprehensive ICT risk management framework. This includes:

• Governance — the management body bears ultimate responsibility for ICT risk
• Risk identification — maintain an up-to-date inventory of ICT assets and systems
• Protection — implement security policies for access control, encryption, and network security
• Detection — deploy monitoring and anomaly detection capabilities
• Response and recovery — maintain and test business continuity plans

Pillar 2: ICT Incident Reporting (Articles 17-23)

Major ICT incidents must be reported to competent authorities within strict timeframes:

• Initial notification — within 4 hours of classification as major
• Intermediate report — within 72 hours
• Final report — within 1 month of resolution

Pillar 3: Digital Operational Resilience Testing (Articles 24-27)

All financial entities must conduct regular testing:

• Basic testing — vulnerability assessments, network security reviews, gap analyses
• Advanced testing — significant entities must perform threat-led penetration testing (TLPT) at least every 3 years, following the TIBER-EU framework

Pillar 4: ICT Third-Party Risk (Articles 28-44)

DORA introduces extensive requirements for managing ICT service providers:

• Maintain a register of all ICT third-party service providers
• Include mandatory contractual provisions (service levels, audit rights, exit strategies)
• Assess and manage concentration risk — over-reliance on a single provider
• Critical providers face direct oversight by European Supervisory Authorities

Pillar 5: Information Sharing (Article 45)

Financial entities are encouraged to participate in cyber threat intelligence sharing arrangements, with appropriate safeguards for confidentiality.

Assessing Your DORA Readiness

DORA is not something you get certified in — it is supervised by your competent authority, and readiness means each article-level requirement across the five pillars is substantiated by current evidence:

1. Map your current state — identify where your evidence stands against each DORA pillar
2. Build your ICT asset register — this is foundational for Pillar 1
3. Document your incident response process — including the classification criteria and reporting templates
4. Compile your testing evidence — vulnerability scans, penetration test reports, DR test results
5. Review vendor contracts — ensure all ICT providers have DORA-compliant contractual provisions, including exit strategies
6. Assess sufficiency, not just presence — a document on file is not the same as evidence judged sufficient for the requirement

How Netallion Helps

Netallion assesses your evidence against DORA's 37 article-level requirements across all five pillars — ICT risk management, incident reporting, resilience testing, third-party risk, and information sharing. Rather than a coverage percentage, each requirement receives a determination of whether the evidence is sufficient, with explicit blockers where it is not — for example, a third-party register that exists but whose critical ICT providers lack exit strategies. Because many crypto-asset service providers are also in scope for DORA, the MiCA readiness path is commonly assessed alongside it.

See how Netallion assesses DORA readiness, or read the assessment methodology for how evidence becomes a readiness conclusion.