DORA’s framework rests on five interconnected pillars that create a comprehensive approach to operational resilience. Understanding these requirements is essential for any organization preparing for compliance.

DORA Framework Domains

1. ICT Risk Management

Article 6 of DORA requires financial entities to establish a robust ICT risk management framework proportionate to their size, complexity, and risk profile. This framework must be approved by the management body and include comprehensive policies covering:

• Risk identification and assessment methodologies
• Protection and prevention measures
• Detection mechanisms for anomalies and threats
• Response and recovery procedures
• Learning and evolving capabilities based on incidents

Organizations must maintain detailed inventories of all ICT assets, document dependencies between systems, and regularly review their risk management frameworks. The regulation emphasizes continuous monitoring and adaptation, requiring entities to update their risk assessments as their technology environment changes.

2. Incident Management and Reporting

DORA introduces standardized incident classification and reporting requirements across the EU financial sector. Financial entities must establish comprehensive incident management processes that include detection, logging, categorization, and escalation procedures.

The regulation distinguishes between different severity levels of incidents. Major ICT-related incidents must be reported to relevant authorities within strict timeframes: an initial notification within four hours of classification, followed by intermediate reports and a final report within one month. This structured approach ensures supervisory authorities maintain visibility into systemic risks across the financial sector.

Entities must also maintain detailed records of all ICT-related incidents, including minor ones that don’t require regulatory reporting. These records serve as valuable learning tools and demonstrate compliance during supervisory reviews.

3. Digital Operational Resilience Testing

Article 24 requires financial entities to implement a comprehensive testing program that validates their ICT systems and controls. The testing framework must be proportionate to the entity’s size and risk profile, encompassing various methodologies:

• Vulnerability assessments and scans
• Open source analysis and network security reviews
• Gap analyses and physical security assessments
• Source code reviews where applicable
• Penetration testing following TIBER-EU or equivalent frameworks

Significant entities must conduct advanced penetration testing at least every three years, simulating real-world attack scenarios. The regulation requires organizations to document testing results, remediate identified weaknesses promptly, and verify that remediation measures are effective.

4. ICT Third-Party Risk Management

DORA acknowledges that modern financial services depend heavily on external service providers, creating concentration risks and potential points of failure. The regulation establishes comprehensive requirements for managing these relationships.

Before entering any contractual arrangement with ICT service providers, financial entities must conduct thorough due diligence assessments. Contracts must include specific provisions addressing service levels, security requirements, audit rights, exit strategies, and data protection measures.

The regulation introduces the concept of Critical ICT Third-Party Service Providers (CTPPs) – vendors whose failure could pose systemic risk to the financial sector. These providers face direct oversight from EU authorities, including the European Supervisory Authorities (ESAs), marking an unprecedented extension of financial regulation into the technology sector.

Organizations must maintain comprehensive registers of their ICT service arrangements, continuously monitor provider performance, and develop strategies for managing concentration risk when multiple critical functions depend on single providers.

5. Information Sharing

DORA encourages financial entities to share information about cyber threats, vulnerabilities, and incidents. This collaborative approach aims to strengthen collective resilience across the sector.

Financial entities may participate in information-sharing arrangements to enhance awareness of ICT-related threats. The regulation protects entities engaging in these arrangements from potential liability, provided the information sharing occurs in good faith and complies with applicable laws including GDPR.