Skip to content
Regulation (EU) 2022/2554European Union

DORA – digital resilience

DORA is directly applicable EU law on ICT risk in the financial sector. Since 17 January 2025, financial entities must run an ICT risk management framework owned by the management body, classify and report major ICT incidents, test their digital resilience and control ICT third-party risk.

Key points

  1. 01
    Applies from 17 January 2025; binding in its entirety and directly applicable in all Member States, without national transposition (Article 64).
  2. 02
    Five pillars: ICT risk management, ICT-related incident management and reporting, digital operational resilience testing, ICT third-party risk, and information-sharing arrangements (Chapters II to VI).
  3. 03
    The management body bears the ultimate responsibility for managing the entity’s ICT risk (Article 5(2)(a)).
  4. 04
    Major ICT-related incidents: initial notification within 4 hours of classification as major and no later than 24 hours after becoming aware; intermediate report within 72 hours of the initial notification; final report within one month of the latest intermediate report (Delegated Regulation (EU) 2025/301, Article 5).
  5. 05
    The European Supervisory Authorities published the first list of designated critical ICT third-party service providers on 18 November 2025.
  6. 06
    For Swiss banking groups, DORA becomes relevant through EU-authorised subsidiaries, ICT services provided to EU financial entities and, under German law, branches in Germany, where the applicable regime depends on the branch’s business.
Status
Published in the Official Journal on 27 December 2022 (OJ L 333); entered into force on the twentieth day after publication and applies from 17 January 2025 (Article 64). Time limits for reporting major ICT-related incidents are set by Delegated Regulation (EU) 2025/301. In Germany, Bafin lists entities brought under DORA by the FinmadiG, among them third-country branches and Zweigstellen nach § 53 KWG: reporting obligations only until 1 January 2027, ICT risk management under Article 16 DORA from that date; an entity that conducts deposit and lending business is a CRR credit institution and has been under DORA since 17 January 2025 (Bafin FAQ, status January 2025). Bafin repeals its BAIT in full with the end of 31 December 2026.

What it requires

  1. 01
    ICT risk management framework
    A sound, comprehensive and well-documented ICT risk management framework as part of the overall risk management system, reviewed at least once a year (Article 6(1) and (5)). Entities other than microenterprises assign ICT risk to an independent control function and separate ICT risk management, control and internal audit functions (Article 6(4)).
  2. 02
    Governance and accountability
    The management body defines, approves, oversees and is responsible for the ICT risk management framework, sets the digital operational resilience strategy including the ICT risk tolerance, approves the ICT business continuity policy and ICT audit plans, and allocates the budget (Article 5(2)). Its members keep sufficient ICT risk knowledge, including through regular training (Article 5(4)).
  3. 03
    Incident management and reporting
    An ICT-related incident management process to detect, manage and notify incidents (Article 17). Major ICT-related incidents are reported to the competent authority as initial notification, intermediate report and final report (Article 19(4)), within the time limits of Delegated Regulation (EU) 2025/301.
  4. 04
    Digital operational resilience testing
    Entities other than microenterprises maintain a testing programme and test all ICT systems and applications supporting critical or important functions at least yearly (Article 24). Entities identified by the competent authority under Article 26(8) carry out threat-led penetration testing (TLPT) at least every three years on live production systems (Article 26).
  5. 05
    ICT third-party risk
    ICT third-party risk is managed as part of ICT risk: a register of information on all contractual arrangements for ICT services, assessment before contracting and exit strategies for services supporting critical or important functions (Article 28), and mandatory contractual provisions set out in one written document (Article 30).
  6. 06
    Critical ICT third-party providers
    The European Supervisory Authorities designate critical ICT third-party service providers and oversee them (Article 31). A provider established in a third country and designated as critical may only be used if it has established a subsidiary in the Union within 12 months of the designation (Article 31(12)).

What it means for the board and executive management

  1. 01
    The management body carries the ultimate responsibility for ICT risk and sets the ICT risk tolerance as part of the digital operational resilience strategy (Article 5(2)(a) and (d)).
  2. 02
    The board needs reporting channels on ICT third-party arrangements, planned material changes and at least major ICT-related incidents with their impact and remediation (Article 5(2)(i)).
  3. 03
    Board members must keep their ICT risk knowledge current through regular training (Article 5(4)); ICT security and resilience training is compulsory for all staff and senior management (Article 13(6)).
  4. 04
    Reporting deadlines measured in hours require a pre-agreed classification and escalation path; for credit institutions, the weekend and holiday relief does not apply to initial notifications and intermediate reports (Delegated Regulation (EU) 2025/301, Article 5(5)).
In MRM-Solution

How MRM-Solution supports it

  1. 01Derive the requirements into each policy’s register, every row with its origin, and count a row only after a person has approved it.
  2. 02See per requirement whether policy, process and governance, and controls hold it: three lamps, and the weakest one counts.
  3. 03Attach controls to the activities they secure, record tests or import results in your own spreadsheet layout, and track deficiencies to closure.
  4. 04Keep an append-only audit trail of who changed what, when and in which role, plus a change log per policy.
Book a demo

Questions executives ask

Does DORA apply to a Swiss bank?

DORA applies to the financial entities listed in Article 2, supervised by the competent authorities of the Member States. For a Swiss banking group it applies directly to EU-authorised subsidiaries such as a credit institution or investment firm. For branches in Germany, Bafin lists third-country branches and Zweigstellen nach § 53 KWG among the entities brought under DORA by the FinmadiG (reporting only until 1 January 2027, ICT risk management under Article 16 thereafter), and states that an entity conducting deposit and lending business is a CRR credit institution under DORA since 17 January 2025. Swiss entities that provide ICT services to EU financial entities are ICT third-party service providers under the Regulation.

What must we report after a major ICT incident, and how fast?

An initial notification as early as possible, within 4 hours of classifying the incident as major and no later than 24 hours after becoming aware of it; an intermediate report at the latest within 72 hours of the initial notification; and a final report no later than one month after the latest intermediate report (Delegated Regulation (EU) 2025/301, Article 5). Where a major incident affects clients’ financial interests, clients must be informed without undue delay (Article 19(3)).

What does DORA change for our ICT outsourcing contracts?

Every ICT service arrangement goes into the register of information (Article 28(3)), contracts must contain the provisions of Article 30 in one written document, and services supporting critical or important functions need exit strategies (Article 28(8)). For providers established in a third country, entities must also consider compliance with Union data protection rules and the effective enforcement of the law in that country (Article 29(2)); a third-country provider designated as critical needs an EU subsidiary within 12 months (Article 31(12)).

Sources

Executive summary for orientation, not legal advice. The official text prevails.
Regulatory hub

Related regulations

All regulations →
Glossary

Related terms

All glossary terms →

Too good to be true? Then we should talk.

30 minutes. Your use case, maximum impact.

info@mrm-solution.com
Area of interest