The Digital Operational Resilience Act (DORA) became applicable across the EU in January 2025, and it's a genuinely different kind of regulation from GDPR or the AI Act — it's specifically about making sure the financial sector can withstand, respond to, and recover from ICT (information and communication technology) disruptions. What makes it relevant well beyond banks and insurers is that it also directly reaches the technology vendors that serve them.
Who DORA actually covers
DORA applies broadly across the EU financial sector — banks, insurers, investment firms, payment institutions, crypto-asset service providers, and several other categories of financial entities. Critically, it also applies to the ICT third-party service providers those financial entities rely on, particularly ones designated as "critical" — meaning a cloud provider, SaaS vendor, or other technology company serving EU financial institutions can be pulled into DORA's scope even though it isn't a financial entity itself.
The five pillars
DORA is organised around five main areas of requirement:
- ICT risk management — a comprehensive framework for identifying, protecting against, detecting, responding to, and recovering from ICT risk, with clear accountability at the management-body level (not delegated entirely to IT).
- ICT-related incident reporting — classifying incidents by severity and reporting major incidents to regulators within defined timeframes, with a move toward more standardised reporting formats across the EU.
- Digital operational resilience testing — regularly testing ICT systems and controls, with the most significant financial entities required to undergo advanced Threat-Led Penetration Testing (TLPT) — a more realistic, adversarial simulation than a standard vulnerability scan.
- ICT third-party risk management — assessing and monitoring risk from third-party ICT providers, including contractual requirements covering things like audit rights, service levels, and exit strategies.
- Information sharing — voluntary arrangements for financial entities to share cyber threat information and intelligence with each other.
Why this reaches technology vendors directly
This is the detail that surprises a lot of SaaS and cloud companies: DORA establishes an oversight framework for ICT third-party providers designated as "critical" to the financial sector, giving EU financial regulators the ability to directly oversee those providers — not just indirectly through the financial entities that use them. Even for providers that aren't formally designated as critical, financial-sector customers will increasingly push DORA-aligned contractual terms and due diligence requirements down the supply chain regardless, simply to satisfy their own third-party risk management obligations.
What financial entities now require from their vendors
In practice, a financial institution's DORA compliance program translates into specific asks of its technology vendors — documented incident notification commitments and timelines, evidence of a genuine ICT risk management program, contractual audit rights, and clarity on subcontracting/subprocessor arrangements. A vendor that can produce this proactively, rather than scrambling when a customer's procurement or compliance team asks, has a real competitive advantage selling into EU financial services.
How it relates to frameworks you may already hold
DORA doesn't ask organisations to reinvent security practice from scratch — its ICT risk management expectations overlap substantially with what ISO 27001 or a mature NIST CSF-aligned program already covers. The distinctive additions are DORA-specific: the incident reporting timelines and formats, the third-party oversight regime, and (for the most significant entities) mandatory threat-led penetration testing.
This guide is general information, not legal advice — whether DORA applies to your organisation directly, and what your specific obligations are, depends on your role in the financial services supply chain. Consult a qualified professional for advice specific to your organisation.
Evidencing ICT resilience for financial-sector customers
ComplianceDesk's DORA framework gives you the five pillars pre-built as trackable controls, with an evidence vault to keep incident response plans, testing records, and third-party risk documentation current — the exact evidence a financial-sector customer's due diligence team will eventually ask for.