Nikos Andreou
Regulatory Compliance Advisor · CJ Solutions
The Digital Operational Resilience Act (DORA) became applicable across the EU on 17 January 2025. Designed to ensure that financial entities can withstand, respond to, and recover from ICT-related disruptions, DORA introduces a comprehensive framework covering risk management, incident reporting, resilience testing, and third-party oversight.
1Who Does DORA Apply To?
DORA applies to a broad range of financial entities including banks, investment firms, insurance companies, crypto-asset service providers, payment institutions, and trading venues. Critically, it also applies to ICT third-party service providers — including cloud providers and data analytics firms — that are deemed critical to the financial sector.
2ICT Risk Management Framework
Firms must establish and maintain a comprehensive ICT risk management framework that identifies, classifies, and documents all ICT assets and their dependencies. The framework must include protection and prevention measures, detection capabilities, response and recovery plans, and regular testing. Senior management is personally accountable for the framework's effectiveness.
3Incident Reporting Requirements
DORA introduces harmonised incident reporting obligations. Major ICT-related incidents must be reported to the relevant national competent authority within strict timeframes: an initial notification within four hours of classification, an intermediate report within 72 hours, and a final report within one month. Firms must also notify affected clients where the incident impacts their financial interests.
4Digital Operational Resilience Testing
Financial entities must conduct regular resilience testing, including basic testing (vulnerability assessments, network security tests) at least annually, and advanced Threat-Led Penetration Testing (TLPT) every three years for significant institutions. TLPT must be conducted by certified external testers and cover live production systems.
DORA represents a step-change in how regulators approach operational resilience in the financial sector. Firms that have not yet begun their DORA compliance journey are already behind. CJ Solutions offers a structured DORA readiness assessment and implementation programme to help you achieve compliance efficiently and cost-effectively.
