{"id":48828,"date":"2026-06-08T14:29:37","date_gmt":"2026-06-08T11:29:37","guid":{"rendered":"https:\/\/trueconf.com/blog\/?p=48828"},"modified":"2026-09-15T11:43:51","modified_gmt":"2026-09-15T08:43:51","slug":"dora-regulation","status":"publish","type":"post","link":"https:\/\/trueconf.com/blog\/reviews-comparisons\/dora-regulation","title":{"rendered":"DORA Regulation: Requirements, Risks and Compliance"},"content":{"rendered":"

The Digital Operational Resilience Act (DORA)<\/em>, Regulation (EU) 2022\/2554, establishes EU-wide requirements for the digital operational resilience of financial entities. It covers ICT risk management<\/a>, major ICT-related incident reporting, resilience testing, ICT third-party risk<\/a>, and voluntary information sharing<\/a>, with additional oversight applying to designated critical ICT third-party service providers.<\/p>\n

DORA has applied since 17 January 2025. As an EU regulation, it is directly applicable across Member States, while supervision and sanctions are carried out by the competent authorities identified under DORA and relevant national frameworks.<\/p>\n

DORA places responsibility for the ICT risk-management framework on the management body of the financial entity, making digital operational resilience a governance responsibility rather than an IT-only issue.<\/p>\n

Communication infrastructure<\/a> can form part of this framework when it supports financial services, incident response<\/a>, or critical or important functions<\/a>.<\/p>\n

Article 14 of DORA requires financial entities to maintain crisis communication<\/a> plans for responsible disclosure of major ICT-related incidents or vulnerabilities to clients, counterparts, and the public as appropriate. Communication channels used for crisis coordination should therefore be assessed within the institution’s ICT risk and continuity planning.<\/p>\n

DORA does not automatically classify every communication platform as critical infrastructure. The applicable controls depend on how the platform is used, whether it supports a critical or important function, and whether it is provided under a contractual arrangement with an ICT third-party service provider.<\/p>\n

Executive Summary: DORA at a Glance<\/h2>\n\n\n\n\n\n\n\n\n\n\n\n
\n

Question<\/strong><\/p>\n<\/th>\n

\n

Direct Answer<\/strong><\/p>\n<\/th>\n<\/tr>\n<\/thead>\n

\n

What is DORA?<\/strong><\/p>\n<\/td>\n

\n

Regulation (EU) 2022\/2554, a directly applicable EU law requiring financial entities to manage ICT risk, report major ICT-related incidents, test resilience, and manage ICT third-party risk; it also establishes an oversight framework for designated critical ICT third-party service providers<\/p>\n<\/td>\n<\/tr>\n

\n

When did DORA become applicable?<\/strong><\/p>\n<\/td>\n

\n

It entered into force on 16 January 2023 and has applied across the EU since 17 January 2025<\/p>\n<\/td>\n<\/tr>\n

\n

Who does DORA apply to?<\/strong><\/p>\n<\/td>\n

\n

The financial entities listed in Article 2, including banks, insurers, investment firms, payment institutions, electronic money institutions, and certain crypto-asset market participants<\/p>\n<\/td>\n<\/tr>\n

\n

What are the five core areas?<\/strong><\/p>\n<\/td>\n

\n

ICT risk management, ICT incident management and reporting, digital operational resilience testing, ICT third-party risk management, and information sharing arrangements<\/p>\n<\/td>\n<\/tr>\n

\n

Who is accountable?<\/strong><\/p>\n<\/td>\n

\n

The management body remains responsible for defining, approving, overseeing, and implementing the ICT risk-management framework<\/p>\n<\/td>\n<\/tr>\n

\n

Why do communication platforms matter?<\/strong><\/p>\n<\/td>\n

\n

Video conferencing<\/a> and messaging platforms<\/a> should be assessed when they are used as ICT services by a financial entity, with additional requirements applying where they support critical or important functions<\/p>\n<\/td>\n<\/tr>\n

\n

Does self-hosting<\/a> remove DORA third-party risk?<\/strong><\/p>\n<\/td>\n

\n

No. Deployment architecture can change the dependency model, but contracted software, support, maintenance, updates, and integrations can remain relevant ICT third-party dependencies<\/p>\n<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n

DORA Compliance Responsibilities by Role<\/h2>\n

DORA becomes easier to interpret when responsibilities are separated between governance, operational teams, and external ICT providers. Outsourcing an ICT service does not transfer the financial entity’s responsibility for managing the associated risk.<\/p>\n\n\n\n\n\n\n\n\n\n
\n

Role<\/strong><\/p>\n<\/th>\n

\n

Primary Responsibility<\/strong><\/p>\n<\/th>\n

\n

Communication Platform Relevance<\/strong><\/p>\n<\/th>\n<\/tr>\n<\/thead>\n

\n

Management body<\/strong><\/p>\n<\/td>\n

\n

Defines, approves, oversees, and remains responsible for the ICT risk-management framework<\/p>\n<\/td>\n

\n

Ensures communication infrastructure is governed according to its role, risks, and criticality<\/p>\n<\/td>\n<\/tr>\n

\n

ICT and security teams<\/a><\/strong><\/p>\n<\/td>\n

\n

Implement risk controls, monitoring, incident response, testing, recovery, and technical safeguards<\/p>\n<\/td>\n

\n

Assess architecture, access control<\/a>s, logs, dependencies, resilience, and recovery procedures<\/p>\n<\/td>\n<\/tr>\n

\n

Procurement and legal teams<\/strong><\/p>\n<\/td>\n

\n

Manage contractual ICT-service requirements and exit provisions<\/p>\n<\/td>\n

\n

Review hosting, support, maintenance, data locations<\/a>, audit rights, service levels, and transition clauses<\/p>\n<\/td>\n<\/tr>\n

\n

ICT third-party provider<\/strong><\/p>\n<\/td>\n

\n

Fulfils contractual obligations and provides information required by the financial entity<\/p>\n<\/td>\n

\n

May provide messaging, video conferencing, maintenance, cloud hosting, support, or related ICT services<\/p>\n<\/td>\n<\/tr>\n

\n

Critical ICT Third-Party Provider<\/strong><\/p>\n<\/td>\n

\n

Subject to the DORA oversight framework after designation<\/p>\n<\/td>\n

\n

Additional ESA oversight applies at provider level<\/p>\n<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n

\n

Insight 1. Outsourcing infrastructure does not outsource DORA accountability.<\/strong><\/em><\/p>\n

A financial entity can outsource hosting, messaging, conferencing, or other ICT services, but the management body’s responsibility for the ICT risk-management framework remains. Vendor selection changes how risk is managed, not who ultimately owns the governance obligation.<\/em><\/p>\n<\/div>\n

Understanding DORA’s Regulatory Architecture and Jurisdictional Reach<\/h2>\n

\"Data<\/p>\n

Unlike a directive, DORA does not require transposition into national law to become applicable. Its core requirements apply directly across the EU, although national competent authorities remain responsible for supervision and Member States provide the applicable national rules for penalties and remedial measures where DORA requires them.<\/p>\n

The regulation is intended to harmonize ICT risk-management and digital operational resilience requirements across the EU financial sector.<\/p>\n

\n

DORA’s scope encompasses an extensive range of financial entities, including:<\/b><\/p>\n