What is DORA and what do I actually have to do?

DORA is Regulation EU 2022/2554 on digital operational resilience for the financial sector, in application since 17 January 2025. It doesn't ask for a document: it asks for real operational capabilities across five pillars — ICT risk management, incident management and reporting, resilience testing, third-party risk management and information sharing. In practice you must know what is on your network, detect and classify incidents, test your systems and control your ICT providers.

What is the penalty for non-compliance with DORA?

Financial entities answer to national competent authorities, with administrative penalties and remedial measures set by Member States. ICT providers designated as critical fall under direct oversight by the European Supervisory Authorities: Article 35 provides for periodic penalty payments of up to 1% of the average daily worldwide turnover, imposed daily, for a maximum of six months, until compliance is restored.

Where do I start to become DORA compliant?

You start with the snapshot: what is on the network, what is exposed, which ICT providers you touch and where the blind spots are. Without an inventory and visibility, every DORA policy is theory. The first concrete step is a network audit that maps systems, flows and dependencies, on which you build risk management, incident reporting and third-party control.

DORA: ICT resilience isn't a document

Q: Does DORA apply to SMEs too?

Yes. DORA applies to around 21 categories of financial entities (Article 2), regardless of size: banks, insurers, investment firms, payment and e-money institutions, crypto-asset service providers and others. Microenterprises have proportionate obligations and are exempt from some requirements, such as advanced penetration testing, but not from the core framework.

Q: What are the five pillars of DORA?

The five pillars are: 1) ICT risk management, with governance and systems visibility; 2) management, classification and reporting of ICT-related incidents to competent authorities; 3) digital operational resilience testing, up to threat-led penetration testing at least every three years for larger entities; 4) ICT third-party risk management, with a register of providers and an EU oversight framework over critical providers; 5) information sharing on threats among financial entities.

DORA is Regulation EU 2022/2554 on digital operational resilience for the financial sector, in application since 17 January 2025. It doesn't ask for a document: it asks for real capabilities across five pillars — ICT risk, incidents, testing, third parties, sharing. In practice: know what is on your network, detect incidents, test your systems, control your providers. The rest is paper.

01What is DORA, and why isn't it just another paper compliance?

DORA — the Digital Operational Resilience Act — is Regulation (EU) 2022/2554, adopted on 14 December 2022 and in application since 17 January 2025 (EUR-Lex, Reg. EU 2022/2554). Being a regulation, not a directive, it applies directly across all Member States: there is no national transposition acting as a buffer, it stands exactly as written.

The difference from many earlier rules is the verb. DORA doesn't say "document", it says "withstand, respond, recover". Its stated aim is a high common level of digital operational resilience, with uniform requirements on the security of the network and information systems supporting the business processes of financial entities. Translated: the regulator doesn't want a folder of policies, it wants an organisation that holds when a cloud provider falls or an attack gets in at night.

A regulation, not a directive. DORA needs no national transposition law to be binding. The European text is already the operating rule, identical in Tallinn, Rome and Madrid.

02Who does DORA apply to? SMEs too?

Yes, and this is the point many underestimate. DORA isn't just for big banks. Article 2 lists around 21 categories of financial entities it applies to, regardless of size: banks, investment firms, insurers and reinsurers, payment and e-money institutions, crypto-asset service providers, fund managers, crowdfunding platforms and more (EUR-Lex, Reg. EU 2022/2554, Art. 2).

For microenterprises the regulation provides a principle of proportionality: some heavier requirements, such as advanced penetration testing, do not apply. But the core framework — ICT risk management, incident reporting, provider control — stays. If you are a financial-sector SME, you are in scope.

The ICT provider trap. Even if you are not a financial entity, if you supply ICT services to one, your DORA clients will push the obligations downstream to you, by contract. And if you become a "critical" provider, you fall under direct European oversight.

03What are the five pillars of DORA?

All of DORA rests on five pillars. They are not chapters of a manual: they are five capabilities that must exist and work.

ICT risk management. Governance, systems inventory, identification of critical functions. You cannot protect what you don't know you have.
Incident management and reporting. Detect, classify and report major ICT-related incidents to competent authorities, with a harmonised process and defined timelines.
Digital operational resilience testing. From vulnerability assessment up to threat-led penetration testing for larger entities.
ICT third-party risk management. Register of providers, minimum contractual clauses, and an EU oversight framework over providers designated critical.
Information sharing. Voluntary exchange of threat information and intelligence among financial entities.

Four pillars out of five presuppose one thing, before any policy: visibility. Without knowing what is on the network and who touches what, risk management, reporting and provider control remain statements of intent.

Resilience isn't a certificate on the wall. It's an organisation that holds when the cloud provider falls at three in the morning.

04The dates and numbers that matter

Three citable figures, from official sources, frame the obligations without noise.

17 Jan 2025

DORA application date (Reg. EU 2022/2554, Art. 64)

~21

categories of financial entities in scope (Art. 2)

3 years

minimum frequency of threat-led penetration testing (Art. 26)

Threat-led penetration testing (TLPT) must be carried out at least every three years by entities identified by the competent authority, on live production systems supporting critical or important functions; microenterprises are excluded (EUR-Lex, Reg. EU 2022/2554, Art. 26). On penalties, ICT providers designated critical fall under the oversight framework of the European Supervisory Authorities: Article 35 provides for periodic penalty payments of up to 1% of the average daily worldwide turnover, applied daily for a maximum of six months, until compliance is restored (EUR-Lex, Reg. EU 2022/2554, Art. 35).

05Why do most DORA projects fail on paper?

The typical mistake is to treat DORA as a documentation exercise: write the policies, fill in the provider register, file it away. Then the real incident arrives, and you discover nobody knew which systems were exposed, which functions were critical, which providers touched the data. The paper was there. The resilience wasn't.

The European oversight framework over critical ICT providers, run by the European Supervisory Authorities, makes the problem structural: designation is based on systemic impact, the importance of the entities depending on the provider, concentration and substitutability (ESMA, Digital Operational Resilience Act). If you don't know who your critical providers are and what they control, you are not managing a risk: you are absorbing it. It's the same principle we defend in European digital sovereignty: control is measured by who touches the data and from which jurisdiction, not by the flag on the datacenter.

The paper was there. The resilience wasn't. That's the gap between having a policy and surviving an incident.

06Where to start, concretely

You start with the snapshot, not the policy. What is on your network, what is exposed, which ICT providers you touch, where the blind spots are. It's the basis of pillars one (ICT risk) and four (third parties), and without it the rest is theory. That's why we almost always propose a network audit as the first step: seven days, on-prem, and in hand a document that maps systems, flows and dependencies.

The snapshot is taken by Munin, our network audit and visibility tool: inventory of what is connected, exposures, provider dependencies. From there, DORA compliance becomes a list of things to close in priority order, mapped to the pillars, not a shapeless monster. The hard part isn't understanding the regulation. It's knowing where you stand. If you want to discuss your case, write to us or look at our sovereign cyber and AI products.

In short. DORA is Reg. EU 2022/2554, in force since 17 January 2025, applying to around 21 categories of financial entities plus critical ICT providers. It asks for five real capabilities — ICT risk, incidents, testing, third parties, sharing — not a folder of documents. Critical providers risk penalties up to 1% of daily turnover. Start with the snapshot of your network, not the policy.