Expertise · Regulation
DORA
The EU's digital operational resilience regulation for the financial sector — covering ICT risk management, incident reporting, resilience testing, and third-party oversight.
What it is, and why it matters.
The Digital Operational Resilience Act (DORA) establishes a single, harmonised framework for digital operational resilience across the EU financial sector. It is built on five pillars: ICT risk management, ICT-related incident reporting, digital operational resilience testing, ICT third-party risk management, and information sharing. It also brings critical ICT third-party providers — such as major cloud and software vendors — under direct EU oversight. For financial entities, DORA turns operational resilience from good practice into a regulated obligation.
Who it affects.
Financial entities across the EU — banks, insurers, investment firms, payment and e-money institutions, crypto-asset service providers, and more — together with the critical ICT third-party providers that serve them.
Key dates
DORA applies from early 2025.
Key obligations.
ICT risk-management framework
ICT-related incident classification and reporting
Digital operational resilience testing
ICT third-party risk management and a register of information
Information and intelligence sharing
Sits under:
Compliance
DORA within your managed office.
DORA sits under Compliance and connects closely to Risk, Governance, and Architecture & Transformation. We manage it as an integrated part of your program — so resilience, risk, and third-party oversight are handled as one system rather than separate compliance exercises.
How we help.
00
Five-pillar gap analysis
Where you stand against each of DORA's pillars.
00
ICT risk-management framework
The framework DORA requires, built and run.
00
Incident classification & reporting
Processes aligned to DORA's reporting rules.
00
Resilience testing programme
A testing regime proportionate to your profile.
00
Third-party risk & register
ICT third-party oversight and the register of information.
00
Board-level oversight
The governance and accountability DORA expects.
Related expertise.
Supply-Chain & Third-Party Risk
Your security is only as strong as your suppliers'. We help you assess, govern, and continuously manage third-party and supply-chain risk — now a direct requirement under NIS2 and DORA.
ISO 27001
The international standard for information security management. We design, implement, and run the ISMS — and take you to certification and beyond.
Risk Management
The living discipline of identifying, assessing, treating, and monitoring risk — aligned to your appetite, so you take the right risks knowingly.
TRUSTED BY ORGANISATIONS ACROSS EUROPE
