What is DORA: complete guide to the Digital Operational Resilience Act

DORA is Regulation (EU) 2022/2554 on digital operational resilience for the financial sector. It entered into force on 16 January 2023 and has applied since 17 January 2025 to EU financial entities and to the ICT service providers that serve them, by contract and, for critical providers, through direct oversight by the European authorities. It requires them to manage ICT risk, report major incidents, test their resilience and keep control of their technology suppliers [1].

This guide walks through the whole regulation: who it applies to, the five pillars, the technical standards that implement it, the timeline, the supervisory and penalty regime in Spain, and a checklist to get started. If you are looking for help to comply, see our DORA compliance service.

What DORA is and why it exists

The Digital Operational Resilience Act starts from a simple observation: the financial sector depends on information systems and technology suppliers, and a failure or cyberattack there can spread to customers, markets and other firms. Before DORA, each Member State and each subsector handled those risks under different rules. The regulation replaces that patchwork with a single European framework [1].

Three features define it:

• It is a regulation, not a directive. It is binding in its entirety and directly applicable in the Member States, with no transposition law. It comes with Directive (EU) 2022/2556, which amends the sectoral financial directives [11].
• It treats ICT risk as business risk. Ultimate responsibility sits with the management body (Article 5(2)), which must define, approve and oversee the framework and keep sufficient knowledge to do so (Article 5(4)).
• It is proportionate. The burden scales with the entity's size, risk profile and complexity (Article 4), and there is a simplified ICT risk management framework for certain small, non-interconnected entities, such as small investment firms or exempt payment institutions (Article 16).

For financial entities, DORA is the sector-specific ICT resilience rulebook and takes precedence over the equivalent NIS2 obligations on ICT risk management and incident reporting. If your organisation is not a financial entity, the reference is our NIS2 compliance guide.

Who DORA applies to

Article 2 lists 20 types of financial entity (points (a) to (t)) and adds ICT third-party service providers [1].

Article 2(3) carves out some players, such as institutions for occupational retirement provision that run schemes with no more than 15 members in total, insurance intermediaries that are micro, small or medium-sized enterprises, or smaller managers of alternative investment funds [1].

What about ICT providers: does DORA apply to them?

Yes, in two ways. The first is contractual: the financial entity stays fully responsible for compliance even when it outsources ICT services (Article 28(1)), so it passes minimum requirements on to its providers by contract (Article 30). The second is direct: the regulation sets up a European oversight framework for critical ICT third-party providers, designated by the European Supervisory Authorities (EBA, EIOPA and ESMA) using the criteria in Commission Delegated Regulation (EU) 2024/1502 [10]. The first list of critical providers was published on 18 November 2025 [12].

A provider that is not designated is not off the hook: its financial-sector customers will still ask it for information, contractual clauses and assurances. To see what an entity will ask of its providers, read our guide to the DORA register of information.

The five pillars of DORA

Source for the structure: Chapters II to VI of the official text [1].

Pillar 1: ICT risk management

The framework must be documented, reviewed at least once a year and subject to internal audit. It covers the identification of assets and critical or important functions (Article 8), protection and prevention (Article 9), anomaly detection (Article 10), response and recovery with continuity plans tested at least yearly (Article 11), backups (Article 12) and learning from incidents, including security training (Article 13). Delegated Regulation (EU) 2024/1774 details the tools, methods and policies, and also covers the simplified framework of Article 16 [8].

Organisations that already run an information security management system start ahead: the DORA framework resembles what ISO 27001 requires, with requirements of its own such as management-body accountability and reporting deadlines.

Pillar 2: ICT incidents

The entity must detect, classify and manage incidents (Articles 17 and 18) and report the major ones to its competent authority (Article 19). Classification rests on criteria such as the number of clients and counterparts affected, duration, geographical spread, data losses, criticality of the services and economic impact, which Delegated Regulation (EU) 2024/1772 makes concrete [2].

Reports follow three stages, set out in Delegated Regulation (EU) 2025/301 with forms from Implementing Regulation (EU) 2025/302 [3] [4]:

Entities may also voluntarily notify significant cyber threats (Article 19(2)) and must inform their clients when a major incident affects their financial interests.

Pillar 3: resilience testing

Article 24 requires a proportionate testing programme, with at least yearly tests of all ICT systems and applications supporting critical or important functions, except for microenterprises (Article 24(6)). Article 25 lists test types: vulnerability assessments, source code reviews, scenario-based tests, performance tests, end-to-end tests and penetration testing, among others [1].

Entities designated by the authorities, based on impact, systemic character and ICT maturity, must carry out threat-led penetration testing (TLPT) on their critical functions at least every three years, using testers that meet Article 27 (Article 26). Delegated Regulation (EU) 2025/1190 sets the criteria, process and requirements for these tests [7]. To understand which offensive exercise fits which case, see Red Team vs pentest and what is a Red Team; Hodeitek delivers pentesting and Red Team engagements.

Pillar 4: ICT third-party risk

This is the longest chapter and usually the heaviest workload. Its main parts:

• General principles (Article 28). Provider risk is managed as part of the ICT risk framework and in a proportionate way. The entity assesses before contracting and must have exit strategies for services supporting critical functions.
• Register of information (Article 28(3)). An inventory of all contractual arrangements with ICT providers, on the templates of Implementing Regulation (EU) 2024/2956 [9]. We have two dedicated guides: the register template and common mistakes in the ICT register.
• Concentration risk (Article 29). A preliminary assessment of dependence on a single provider or on closely connected providers.
• Contractual clauses (Article 30). Minimum contract content, with extra requirements for critical or important functions. Delegated Regulation (EU) 2024/1773 covers the contractual policy [5] and 2025/532 covers subcontracting [6].
• Oversight of critical providers (Articles 31 to 44). The European authorities exercise direct oversight, with a lead overseer for each provider.

For this pillar, Hodeitek's digital supply chain risk management solution works on the provider inventory, its assessment and its follow-up.

Pillar 5: information sharing

Article 45 lets entities share cyber threat information and intelligence within trusted communities, with confidentiality and data-protection safeguards. It is voluntary, and participating entities must notify their competent authority [1].

Timeline: key DORA dates

Sources: [1] [2] [12].

Technical standards implementing the regulation

DORA is completed by Commission delegated and implementing acts. These are the main ones:

All are available on EUR-Lex: [2] [3] [4] [5] [6] [7] [8] [9] [10].

Competent authorities and penalties in Spain

DORA applies directly, but supervision is national. In Spain the practical split is as follows, according to the procedures of the Banco de España [15] and the CNMV [16]; for the DGSFP, [14]:

Channels can change: confirm the current one on your authority's website before reporting.

What penalties does DORA provide for

Article 50 requires Member States to give authorities supervisory, investigatory and sanctioning powers, and to lay down proportionate penalties and remedial measures [1]. Critical providers can face periodic penalty payments from the lead overseer of up to 1% of their average daily worldwide turnover (Article 35(8)).

In Spain, Article 4 of Royal Decree-Law 8/2023 applies Chapter II of DORA (ICT risk management) to payment system, payment scheme and electronic payment arrangement operators, payment processors and other technology or technical providers serving Spain, and designates the Banco de España as supervisory and sanctioning authority [13]. For all other entities, check the BOE and your competent authority's website for the national penalty regime currently in force.

DORA compliance checklist

A reasonable sequence for an entity getting started:

To follow up on providers, HodeiShield offers vendor scoring and periodic scheduled scans that support the inventory of ICT third parties; the use case explains what the platform covers and what it does not. If you prefer full support, our GRC consulting team and the DORA compliance service cover the diagnosis and the roadmap.

Common mistakes when approaching DORA

Compliance projects tend to trip over the same points:

• Treating it as an IT project. The regulation puts responsibility on the management body. If the board neither approves the framework nor receives regular reporting, the most basic piece is missing.
• Starting with contracts instead of the inventory. Without knowing which ICT services support which critical or important functions, you cannot prioritise which contracts to review or which providers to assess first.
• A one-off register of information. The register must stay current and match the contracts in force; an outdated inventory is a finding in any inspection.
• Forgetting subcontracting. The subcontractor chain of a provider that supports a critical function is part of the analysis too.
• Confusing vulnerability scanning with advanced testing. An automated scan covers part of Article 25 but does not replace a TLPT when the authority requires one.
• Rehearsing incident reporting too late. Deadlines are short and the forms are detailed: simulate a report before you need one.

DORA in a small entity: proportionality in practice

A small payment institution, a small investment firm or a small UCITS management company are also in scope, but they do not have to replicate the apparatus of a systemic bank. Article 4 requires applying the regulation in light of size, risk profile and the complexity of the services, and Article 16 offers a simplified ICT risk management framework for certain small, non-interconnected entities, such as small investment firms or exempt payment institutions [1], which Delegated Regulation (EU) 2024/1774 develops [8].

Proportionality is not exemption. What shrinks is depth, not the existence of the processes: you still need a documented framework, an incident process, a provider register and contracts with the minimum clauses. A small entity usually gains more from a phased roadmap than from trying to cover everything at once.

DORA, NIS2, ENS and ISO 27001: how they relate

• NIS2 is the general cybersecurity directive for essential and important sectors. Financial entities covered by DORA follow this sector-specific regulation; read the NIS2 guide if your activity falls outside the financial sector.
• ENS is Spain's National Security Framework, mandatory for the public sector and its suppliers. It does not replace DORA, but its documentation discipline helps. See the ENS guide and the ENS solution.
• ISO 27001 is a voluntary information security management standard. It gives method and evidence, but on its own it does not cover DORA's specific requirements; see the ISO 27001 guide.

This guide is informational and does not replace legal advice. Updated on 13 November 2026.