DORA
DORA · Digital Operational Resilience Act · Regulation (EU) 2022/2554 · digital operational resilience · critical ICT third-party providers · TLPT
The EU regulation, applicable since 17 January 2025, that requires the financial sector (banks, insurers, asset managers, payment institutions and others) to control its ICT risks and those of its providers.
In practice
DORA rests on five pillars: ICT risk management under the responsibility of the management body, incident management and reporting, resilience testing (including threat-led penetration testing, or TLPT, for the largest players), management of ICT third-party providers, and threat information sharing. A major incident is reported to the supervisor (the ACPR or AMF in France) in three stages: initial notification within 4 hours of classifying it as major and no later than 24 hours after becoming aware of it, intermediate report within 72 hours, final report within one month. Contracts with ICT providers must contain specific clauses (audit, exit, data location), and providers designated as critical are overseen directly by the European supervisory authorities.
Fictional case: a 30-person SaaS vendor selling a management tool to insurers receives a DORA contract amendment: right to audit, incident notification, exit plan, participation in testing. Although not directly subject to the regulation, it has to apply part of it by contract.
