What is the Digital Operational Resilience Act (DORA)? Everything you need to know

The Digital Operational Resilience Act (DORA) is a comprehensive EU regulation aimed at financial entities and their third-party information and communications technology (ICT) providers.

‍

As a new and largely unexplored regulation, many affected organizations are still in the process of aligning their cybersecurity and risk management processes with the framework.

‍

Complete DORA compliance has been mandatory since January 17, 2025, so many security and compliance teams are looking to adopt the regulation’s requirements within tight timelines.

‍

This guide will help you get a thorough idea of the regulation’s impact on your organization and what you need to prepare for. We’ll cover:

• The meaning, purpose, and scope of DORA
• The regulation’s general structure
• An overview of the compliance process
• Applicable deadline and penalties
• Challenges to achieving compliance (and how to resolve them)

‍

What is the Digital Operational Resilience Act (DORA)?

DORA is a new EU framework for ensuring enhanced cybersecurity and operational resilience of financial entities operating in the Union. Its main goal is to strengthen the finance and insurance sectors’ resilience to ICT threats and incidents through harmonized governance.

‍

The regulation was drafted in 2022 and came into effect on January 16, 2023. This left 24 months for the affected entities to familiarize themselves with DORA’s requirements and achieve compliance by January 17, 2025.

‍

Like the EU’s other major regulations (e.g., GDPR), DORA is a mandatory framework. The good news is that it offers a clear set of requirements, guidelines, and instructions that affected entities can follow to achieve compliance.

‍

 {{cta_withimage22="/cta-modules"}} 

‍

DORA’s scope: Who needs to comply?

DORA is primarily aimed at organizations that provide financial services—including insurance—in the EU. Examples of entities that need to comply include:

• Banks
• Investment firms
• Account information service providers
• Trade repositories
• Crypto-asset service providers
• Payment and credit institutions

‍

DORA also applies to ICT providers serving companies in the EU, even if they’re based outside of the Union. Cloud providers, network security firms, and similar entities serving EU-based financial entities must also meet all the applicable requirements.

‍

According to PwC’s estimates, DORA affects over 22,000 financial entities and ICT providers. If you’re among them, you must ensure your security policies and infrastructure adhere to the regulation’s standards.

‍

DORA’s 5 key pillars

DORA’s governance structure is built on the five pillars explained in the following table:

‍

The relationship between DORA and other related frameworks

DORA considerably overlaps with NIS 2, an EU directive that addresses the cybersecurity of EU organizations. This means that if your organization is NIS 2-compliant, you might only need a few additional compliance workflows to adhere to DORA as well.

‍

Still, there’s a notable difference between NIS 2 and DORA—the former isn’t sector-specific. In terms of scope, here are two points to consider:

1. If the measures implemented under sector-specific regulations like DORA are “at least equivalent” to those under NIS 2, the corresponding NIS 2 provisions don’t apply
2. If an entity affected by NIS 2 isn’t covered by a sector-specific regulation, the relevant NIS 2 provisions continue to apply to them

‍

Most importantly, EU Member States may not want to prioritize reviewing NIS 2 provisions related to cybersecurity risks and reporting obligations for any financial entity that’s already covered by DORA.

‍

DORA doesn’t only overlap with NIS 2 but also with other major standards and regulations, most notably:

• SOC 2
• ISO 27001
• NIST CSF

‍

If you already comply with the above standards, you might get a considerable headstart with DORA compliance. For example, the regulation has a ~50% overlap with the requirements of ISO 27001, which means you’re already halfway there if you hold an ISO 27001 certificate.

‍

How to ensure DORA compliance: 5 key steps

While the specific steps to DORA compliance largely depend on your current security posture and program maturity, the general process involves the following steps:

‍

1. Set compliance goals: Review DORA’s Article 2 to assess the regulation’s scope and understand its applicability to set compliance goals accordingly. You might have to comply out of necessity or use compliance as an opportunity to expand your operations to the EU.
2. Analyze your current state: Perform a comprehensive security review to understand your current compliance posture and implemented controls. Assess your technical, procedural, and administrative security controls, as well as your existing third-party risk management program.
3. Identify compliance gaps and next steps: Familiarize yourself with DORA’s requirements within each of the five pillars to identify all compliance gaps. Develop a gap remediation strategy to incrementally introduce all the necessary changes without considerable operational disruptions.
4. Implement missing controls: Depending on your security program maturity, you might need to implement numerous controls and processes (threat-led penetration testing, incident reporting centralization, etc.). Start with controls that don’t require considerable process overhauls, and work your way to the more demanding ones.
5. Self-attest framework completion: After implementing all the necessary controls, review them against DORA’s requirements to complete self-attestation. Make sure to check any specific guidelines from local financial services regulators that will lead the implementation of DORA in specific Member States (e.g., the Prudential Supervision and Resolution Authority in France).

‍

DORA compliance deadline and penalties

All in-scope financial entities and ICT service providers need to ensure DORA compliance as of January 17, 2025. Some of the main deliverables you need to have in place include:

• A defined ICT risk management framework
• Ongoing ICT monitoring system
• Incident reporting process
• Business continuity plans

‍

Non-compliance with DORA can lead to various penalties set by competent authorities. You can review Article 46 to see which authority covers your organization, considering that they vary between specific niches within the financial sector.

‍

Some of the expected non-compliance penalties include:

• Cease and desist orders for non-compliant operations
• Temporary or permanent closure or cessation of any non-compliant practices
• Criminal penalties for severe data breaches or security issues

‍

Senior executives of non-compliant entities may suffer direct legal consequences, the severity of which depends on the extent of violations. European Supervisor Authorities (ESAs) have already started their oversight activities, so it’s crucial to ensure seamless compliance and avoid such consequences. The problem is that DORA is quite comprehensive, so adopting the framework quickly can be a considerable challenge.

‍

 {{cta_withimage22="/cta-modules"}}

‍

Common DORA compliance challenges

While pursuing DORA compliance, you might encounter the following obstacles:

• Poor visibility of the ICT supply chain: Large organizations often have complicated supply chains with various upstream and downstream partners, plus the additional fourth parties that should be considered. This complicates the inventory process and the mapping of dependencies and vulnerabilities, slowing down DORA compliance.
• Lack of sufficient security program maturity: Organizations with low-maturity security programs must implement numerous controls to become DORA-compliant and will likely notice considerable compliance gaps. The number of controls and the complexity of their implementation might be overwhelming, especially without adequate guidance.
• Manual cybersecurity workflows: If your security reviews, software patches, and other cybersecurity processes involve inefficient activities (e.g., manual point-in-time vulnerability scans), you might prolong the DORA compliance time frame. The same is true if your evidence-collection processes rely on disparate systems like email chains and scattered spreadsheets or documents.
• Inefficient incident reporting process: DORA requires an efficient incident reporting process that doesn’t leave room for inefficiencies and communication delays (e.g., asynchronous communication channels like emails). The best practice here is to streamline and automate reporting.
• Limited in-house DORA expertise: As DORA is still relatively new, your team members may not have had a chance to familiarize themselves with all of its nuances. Getting up to speed with the regulation’s requirements might take considerable team capacity, which you may not have to spare, considering DORA is already in effect.

‍

The good news is that you can overcome many of these challenges by combining efficient processes with capable compliance software.

‍

{{cta_withimage3="/cta-modules"}}

‍

Ensure DORA compliance with Vanta

Vanta is a comprehensive trust management platform that significantly automates and simplifies the compliance workflows for DORA. It removes numerous inefficient processes and resource-draining activities to help you achieve complete compliance faster, often within six to ten weeks.

‍

To achieve this productivity boost, Vanta offers a dedicated DORA product. It comes with various features that help you tighten and track your compliance workflows, most notably:

• Unified compliance program management
• Ongoing insights into your compliance status with automated tests
• Pre-built templates and policies tailored to DORA’s controls
• Continuous guidance through the compliance process provided by expert auditors
• Automated evidence collection supported by over 375 integrations

‍

With Vanta, you get the technical and procedural support you need to stay compliant. That way, you can not only ensure initial DORA compliance but continuously maintain your operational resilience to remain in good standing with the regulation.

‍

Additionally, the platform offers other compliance products tailored to your organization’s needs, ensuring all your compliance workflows are manageable from a streamlined hub.

‍

Schedule a custom demo of Vanta’s DORA product to get a hands-on overview of the platform.

‍

{{cta_simple27="/cta-modules"}} 

‍

‍A note from Vanta: Vanta is not a law firm, and this article does not constitute or contain legal advice or create an attorney-client relationship. When determining your obligations and compliance with respect to relevant laws and regulations, you should consult a licensed attorney.