DORA: digital operational resilience in the financial sector

What DORA requires

Regulation (EU) 2022/2554, known as DORA (the Digital Operational Resilience Act), has applied directly across the EU since 17 January 2025, without national transposition. It consolidates the requirements for the digital operational resilience of the financial sector and binds financial entities as well as their ICT service providers. It is specified further by technical standards (RTS and ITS). DORA rests on five building blocks:

• ICT risk management (Chapter II): governance and a framework for detection, protection, response and recovery, under the responsibility of the management body.
• Managing and reporting ICT-related incidents (Chapter III): detect and classify incidents and report major incidents to the supervisor within fixed deadlines (initial notification within 24 hours at the latest, intermediate report within 72 hours, final report within one month; in Germany to BaFin).
• Digital operational resilience testing (Chapter IV): a risk-based testing program with vulnerability assessments and penetration tests, at least annually for systems supporting critical or important functions. For significant entities designated by the authorities, threat-led penetration testing (TLPT) is added.
• Managing ICT third-party risk (Chapter V): governing your ICT service providers across the full lifecycle, a register of information covering all contracts and minimum contractual content under Article 30, including audit and access rights, security requirements and exit strategies.
• Information sharing (Chapter VI): the voluntary exchange of cyber threat intelligence.

DORA applies proportionately: scope and depth depend on size, risk profile and business activity. For certain smaller entities, Article 16 provides a simplified ICT risk management framework.

Are you affected?

Around 20 categories of financial entities are covered, including credit, payment and e-money institutions, investment firms, insurers and insurance intermediaries, fund and management companies, and crypto-asset service providers. Even if you are not a financial entity, DORA can reach you: as an ICT service provider (cloud, SaaS, software, IT operations) to EU financial entities, DORA’s requirements are passed on to you through their contracts. Whether and to what extent DORA applies to you is something we clarify with you in an initial call.

Test evidence: our entry point

The testing program under Chapter IV includes vulnerability assessments and penetration tests that cover systems supporting critical or important functions at least annually. As a BSI-certified provider for IS penetration testing (BSI-APS-9080), we deliver these tests and prove the effectiveness of your measures independently. For most financial entities, this is the relevant testing obligation.

If your institution is designated by the authorities for a threat-led penetration test (TLPT), the bar is higher: TLPT is intelligence-led red teaming against production systems following the TIBER-EU framework (in Germany TIBER-DE, coordinated by the Deutsche Bundesbank and BaFin), with its own requirements for the testers and a defined process. A regular penetration test or vulnerability scan does not replace a TLPT. We prepare you for it with red teaming and attack simulation (TLPT readiness) and support you through the official process.

How we work

1. 1
   Classification
   Clarify applicability and role, full or simplified framework.
2. 2
   Gap analysis
   Assess your position against the five building blocks.
3. 3
   Implementation
   Anchor the measures, set up the Chapter IV testing program.
4. 4
   Test evidence
   Verify effectiveness and document it in auditable form.

We credit an existing ISMS or outsourcing management rather than starting from scratch. We prove effectiveness with a penetration test, and you receive auditable evidence for the supervisor.

How we support you

• Penetration tests and vulnerability assessments for the regular testing program under Chapter IV, with auditable evidence of effectiveness.
• Red teaming and attack simulation to prepare for a threat-led penetration test (TLPT readiness), based on TIBER-EU.
• ISMS and ICT risk management as the foundation for Chapter II. An ISMS to ISO 27001 covers a lot but does not automatically make you DORA-compliant. In a gap analysis we show the remaining effort.
• Business continuity management for the required continuation and recovery of critical functions.
• ICT third-party risk: support with the register of information, contract review under Article 30 and the technical assessment of your provider connections.
• Incident response readiness: tabletop and scenario exercises so that your reporting and response processes work under DORA’s deadlines when it matters.

Supervisory responsibility, for example for reporting and the register of information, remains with you. We provide expert support and the evidence, but do not replace your obligations.

Do you also fall under NIS-2? For financial entities, DORA is the more specific regime in its areas. We delineate which regime covers which obligation so that you avoid duplicate work. As a Swiss financial entity or ICT service provider, you can be affected through EU subsidiaries or through contracts with EU financial entities, while the FINMA requirements continue to apply in parallel. We map both in the same contracts and a single register.