DORA Comes Into Effect
On January 17, 2025, the EU Digital Operational Resilience Act (DORA) entered into force. It establishes a unified framework for ICT risk management in the financial sector, ensuring institutions can withstand, respond to, and recover from digital disruptions. DORA applies to a wide range of entities, from banks to crypto-asset service providers.
Legislative Background and Objectives
Previously, ICT risk management in the EU financial sector was fragmented across member states. DORA addresses this by harmonizing regulations and creating common technical standards to eliminate overlaps and gaps. Its two main objectives are to strengthen ICT risk management and unify regulatory requirements across the EU.
Scope and Key Definitions
DORA applies broadly to financial institutions, including banks, insurers, investment firms, and crypto-asset providers, as well as third-party ICT service providers such as cloud services. Critical providers will be directly supervised by European Supervisory Authorities (ESA) and may face fines of up to 1% of global average daily turnover until compliance is achieved. Small entities under defined thresholds may be exempt, but overall the regulation covers nearly the entire financial ecosystem.
Five Pillars of the Framework
• ICT Risk Management and Governance: Institutions must establish a documented ICT risk framework, map critical assets, conduct regular assessments, and ensure board-level responsibility.
• Incident Management and Reporting: Entities must monitor and report ICT incidents. Major incidents require initial, intermediate, and final reports, with strict deadlines for the initial submission.
• Resilience Testing: Regular tests, including vulnerability and scenario-based assessments, are mandatory. Critical entities must conduct a Threat-Led Penetration Test (TLPT) every three years under the updated TIBER-EU framework.
• Third-Party Risk Management: Institutions must perform due diligence, ensure contractual safeguards, and avoid concentration of critical functions with limited providers. Authorities can suspend or terminate non-compliant contracts.
• Information Sharing: Entities are encouraged to exchange information on threats and incidents, while ensuring GDPR compliance for personal data.
Compliance and Implementation
Financial institutions face major compliance challenges, requiring immutable backups, anomaly detection, isolated recovery, and thirdparty risk reviews. Gap analyses and implementation roadmaps are essential.
DORA sets a comprehensive resilience standard, but overlaps with GDPR—such as threat-sharing vs. data minimization—create added complexity. This makes precise data labeling and classification critical to track what data is stored, processed, and shared.
S8fe’s automated solutions build this inventory, aligning DORA’s resilience demands with GDPR’s privacy rules. A strong data foundation ensures both compliance and digital resilience.