Home / Knowledge hub / DORA
Knowledge hub
DORA
An EU regulation on digital operational resilience for financial firms.
What it means
DORA is the Digital Operational Resilience Act, Regulation (EU) 2022/2554. It sets one set of rules across the EU for how banks, insurers, payment firms, investment firms and other financial entities manage technology risk. It has applied since 17 January 2025.
The aim is that a financial firm keeps working, or recovers fast, when its technology fails or is attacked. It covers five areas: ICT risk management, incident reporting, resilience testing, third-party risk, and information sharing. Regulators supervise these duties, and proportionality applies to smaller firms.
Why it matters
If you sell software to a financial firm in the EU, DORA reaches you through your customer. They must keep a register of their ICT suppliers, include set terms in contracts, and check that suppliers can meet them. Expect security questions you did not get a year ago.
Testing is a specific theme. Firms must run a programme of resilience tests, and certain larger firms must also run threat-led penetration testing at least every three years. Your product can be part of the scope when it supports an important function of the customer.
How it shows up
You meet DORA in due-diligence requests, contract addenda, and demands for evidence of testing and incident handling. Typical asks cover how you find and fix vulnerabilities, how fast you report an incident to the customer, and whether you test your applications and APIs on a schedule.
Prepare by keeping a clean vulnerability management record, an incident response plan you have rehearsed, and recent pentest reports with retest results. Read the contract clauses closely, because exit and audit rights now appear in them. Keep copies ready for the questionnaires your customers will send.
Questions people ask
DORA, answered
Who does DORA apply to?
Financial entities in the EU such as banks, insurers, payment and e-money institutions and investment firms, plus the ICT third-party providers that serve them.
Some providers designated as critical face direct oversight by EU authorities.
Is DORA the same as NIS2?
No. Both are EU laws on cyber resilience, but DORA is specific to the financial sector and is more detailed on testing and suppliers. For financial firms DORA takes precedence on the overlapping points.
NIS2 covers a broader set of sectors.
Does DORA require penetration testing?
It requires a digital operational resilience testing programme, which can include vulnerability assessments, scans and penetration tests. Threat-led penetration testing is required at least every three years for firms the authorities identify.
Smaller firms follow a lighter, proportionate version.
What must be reported under DORA?
Major ICT-related incidents must be reported to the financial regulator on a fixed timetable, starting with an initial notification, then an intermediate and a final report.
Your customers will rely on you to tell them quickly so they can meet that timetable.
How does DORA affect a small software supplier?
Mostly through contracts. Your financial customer must make sure you meet security and reporting terms, so you may see audit rights, incident clauses and requests for test evidence.
Having reports and a process ready shortens those conversations.
Sources
Where this comes from
Related
Terms that sit next to this one
NIS2
An EU directive setting security and reporting duties for many essential businesses.
Vendor risk management
Judging and monitoring the security of the suppliers your business relies on.
Fourth-party risk
The risk that comes from your suppliers' own suppliers.
Penetration test
A time-boxed engagement where skilled people attack your systems by hand.
Business continuity
Keeping critical services running, or restoring them fast, through a disruption.
Can you show recent test evidence?
Financial customers want testing evidence from their suppliers. We can produce proof-backed findings on your web apps and APIs, and prove each fix by re-running the exact exploit. Book a pilot on one app.
Or start with a $199 pilot on one application: thirty days, success criteria agreed before day one, credited against the annual if you convert.