DORA

The EU's digital operational resilience regulation for the financial sector — covering ICT risk management, incident reporting, resilience testing, and third-party oversight.

Start a Conversation

‹ Baseline Information Security for Government 2 (BIO2)

What it is — and why it matters.

The Digital Operational Resilience Act (DORA) establishes a single, harmonised framework for digital operational resilience across the EU financial sector. It is built on five pillars: ICT risk management, ICT-related incident reporting, digital operational resilience testing, ICT third-party risk management, and information sharing. It also brings critical ICT third-party providers — such as major cloud and software vendors — under direct EU oversight. For financial entities, DORA turns operational resilience from good practice into a regulated obligation.

Who this affects.

Financial entities across the EU — banks, insurers, investment firms, payment and e-money institutions, crypto-asset service providers, and more — together with the critical ICT third-party providers that serve them.

What's involved

How we help.

Five-pillar gap analysis | Where you stand against each of DORA's pillars.
ICT risk-management framework | The framework DORA requires, built and run.
Incident classification & reporting | Processes aligned to DORA's reporting rules.
Resilience testing programme | A testing regime proportionate to your profile.
Third-party risk & register | ICT third-party oversight and the register of information.
Board-level oversight | The governance and accountability DORA expects.

Governance

Within your managed office.

DORA sits under Compliance and connects closely to Risk, Governance, and Architecture & Transformation. We manage it as an integrated part of your program — so resilience, risk, and third-party oversight are handled as one system rather than separate compliance exercises.

Related expertise

Topic

Enterprise Security Architecture

A business-driven, enterprise-wide architecture that links security to strategy — from business context down to logical and physical design, so every control traces back to a goal.

Topic

Information Security Architecture

The structured design of security controls across your technical estate — identity, network, data, cloud, endpoints — as one coherent system aligned to your risks.

Topic