Skip to content
Emergency helpGet started
Compliance & Governance

DORA Compliance: What the Digital Operational Resilience Act Requires

DORA, Regulation (EU) 2022/2554, has applied since 17 January 2025. Who it covers, the five pillars, incident reporting deadlines and ICT third-party risk.
By VigilbasePublished
Read the guideMore Topics

DORA compliance means meeting Regulation (EU) 2022/2554, the Digital Operational Resilience Act, which has applied since 17 January 2025 to banks, payment and e-money institutions, investment firms, insurers, crypto-asset service providers and other EU financial entities. It sets uniform requirements for ICT risk management, ICT-related incident reporting, digital operational resilience testing, ICT third-party risk and information sharing, and creates an EU oversight framework for critical ICT third-party service providers. This guide summarizes the regulation and its technical standards, using the texts on EUR-Lex and the European Supervisory Authorities' pages.

Who does DORA apply to?

Article 2 lists 20 types of financial entities, plus ICT third-party service providers. EIOPA describes DORA as applicable to 20 different types of financial entities and ICT third-party service providers. Financial entities apply the rules in proportion to their size, overall risk profile and the nature, scale and complexity of their services (Article 4).
1.Credit institutions, payment institutions, account information service providers and electronic money institutions.
2.Investment firms, trading venues, central counterparties, central securities depositories, trade repositories and data reporting service providers.
3.Managers of alternative investment funds and management companies.
4.Insurance and reinsurance undertakings, insurance intermediaries and institutions for occupational retirement provision.
5.Crypto-asset service providers and issuers of asset-referenced tokens.
6.Credit rating agencies, administrators of critical benchmarks, crowdfunding service providers and securitisation repositories.
7.Article 2(3) excludes some entities, including insurance intermediaries that are micro, small or medium-sized enterprises and occupational pension institutions whose schemes have no more than 15 members in total.

When did DORA start to apply?

DORA was published in the Official Journal on 27 December 2022, entered into force on 16 January 2023 and has applied since 17 January 2025 (Article 64). As a regulation, it is binding in its entirety and directly applicable in every Member State. The detail sits in Commission delegated and implementing regulations drafted by the European Supervisory Authorities (ESAs): the EBA, EIOPA and ESMA.

The five pillars of DORA

EIOPA summarizes what DORA covers in five areas, often called its five pillars, alongside the oversight of critical ICT third-party providers.
1.ICT risk management (Chapter II): a sound, comprehensive and documented ICT risk management framework, reviewed at least once a year. The management body defines, approves, oversees and is responsible for it, and bears ultimate responsibility for ICT risk.
2.ICT-related incident management, classification and reporting (Chapter III): a process to detect, manage and notify incidents, and reports on major ICT-related incidents to the competent authority.
3.Digital operational resilience testing (Chapter IV): a testing programme, with appropriate tests at least yearly on all ICT systems and applications supporting critical or important functions. Entities identified by their competent authority carry out threat-led penetration testing at least every three years.
4.ICT third-party risk management (Chapter V): a strategy on ICT third-party risk, a register of information on ICT contracts and key contractual provisions.
5.Information sharing (Chapter VI): financial entities may exchange cyber threat information and intelligence within trusted communities, and notify their competent authority when they join or leave such arrangements.

ICT incident reporting under DORA

Article 17 requires an ICT-related incident management process and a record of all ICT-related incidents and significant cyber threats, with root causes identified, documented and addressed. Article 18 sets the classification criteria: clients and transactions affected, duration and downtime, geographical spread, data losses, criticality of the services affected and economic impact. Major ICT-related incidents are reported to the competent authority under Article 19, on the deadlines in Commission Delegated Regulation (EU) 2025/301.
1.Initial notification: within four hours of classifying the incident as major, and no later than 24 hours after becoming aware of it.
2.Intermediate report: within 72 hours of the initial notification, then updated when regular activities have been recovered.
3.Final report: no later than one month after the latest intermediate report.
4.If a deadline falls on a weekend or bank holiday, a report may be submitted by noon the next working day. Credit institutions, central counterparties, trading venue operators and entities that are essential or important under NIS2 cannot use this for initial notifications or intermediate reports.
5.Where a major incident affects clients' financial interests, financial entities inform those clients without undue delay, together with the measures taken to mitigate it.

ICT third-party risk and the register of information

A financial entity that uses ICT third-party services remains fully responsible for meeting its DORA obligations (Article 28). It keeps a register of information on all contractual arrangements for ICT services, distinguishing those that support critical or important functions, reports at least yearly to its competent authority on new arrangements, and makes the full register available on request. Article 30 lists what ICT contracts must contain, including a description of the services, the locations where data is processed, data protection provisions, service levels, assistance during ICT incidents at no additional cost or at a cost set in advance, cooperation with the authorities, and termination rights. The ESAs designate critical ICT third-party service providers and appoint a Lead Overseer for each, which can impose periodic penalty payments of up to 1% of the provider's average daily worldwide turnover (Articles 31 and 35).

How DORA relates to NIS2

For financial entities that are essential or important entities under the NIS2 Directive, DORA counts as a sector-specific Union legal act (Article 1(2) of DORA). Under Article 4 of NIS2, where such an act's risk-management and incident-notification requirements are at least equivalent, the matching NIS2 provisions do not apply to those entities. Member States may also ask financial entities to send their DORA incident reports to the NIS2 authorities or CSIRTs. In Portugal, Decree-Law No. 125/2025 names Banco de Portugal, the CMVM and the ASF as special cybersecurity authorities for the digital operational resilience of the financial sector.

Penalties under DORA

DORA does not set one EU-wide fine. Member States lay down administrative penalties and remedial measures that are effective, proportionate and dissuasive, and competent authorities can access documents, carry out on-site inspections and require corrective measures (Article 50). Check the national law that applies to your entity.

Where logging, investigations and incident records help

DORA asks for detection mechanisms with alert thresholds (Article 10), a record of every ICT-related incident (Article 17) and reviews after major incidents (Article 13). The ICT risk management standards in Delegated Regulation (EU) 2024/1774 add logging procedures that define the events to log, the retention period and the protection of logs against tampering (Article 12). Vigilbase OS helps you produce evidence for these.
1.Detection: Vigilbase OS connects the security tools you already pay for and keeps their logs and events auditable and queryable in one place. The Vigil agent investigates high-severity incidents, and Vigilbase analysts handle exceptions.
2.Incident records: each investigation records the evidence, the actions taken and the verification, which your team can use when classifying and reporting an incident.
3.Log retention: default retention is set per dataset, typically 30 to 90 days. Check it against the retention period your logging procedures set.
4.Authority: you choose whether actions stay off, are proposed for approval, or run when they are low-risk and reversible.
5.Third parties: if you use Vigilbase, record it in your register of information like any other ICT service.

Responsibility and legal note

Vigilbase does not make a financial entity DORA compliant, and the regulation keeps responsibility with the financial entity and its management body. This guide summarizes Regulation (EU) 2022/2554 and its technical standards as published on EUR-Lex in October 2026. It is not legal advice: your compliance and legal teams decide how DORA applies to your entity.

Key Takeaways

✓DORA, Regulation (EU) 2022/2554, has applied to EU financial entities since 17 January 2025.
✓Its five pillars are ICT risk management, incident reporting, resilience testing, ICT third-party risk and information sharing.
✓Major ICT-related incidents need an initial notification within four hours of classification and no later than 24 hours after detection, an intermediate report within 72 hours and a final report within one month.
✓Financial entities keep a register of information on all ICT contracts and remain fully responsible when they outsource.
✓Logs, investigation records and incident records are evidence you will need, but responsibility stays with the entity and its management body.

Sources

Related Solutions

Vigilbase services related to this guide

Vigilbase OS

Learn more

Managed SOC

Learn more

Cybersecurity for banking and financial services

Learn more

Cybersecurity for fintech

Learn more

Vigilbase SLA

Learn more

Frequently Asked Questions

When did DORA come into force?

DORA entered into force on 16 January 2023 and has applied since 17 January 2025. It is a regulation, so it is directly applicable in every EU Member State without national transposition.Choose a package for financial servicesDiscuss your scope with Vigilbase

Who has to comply with DORA?

DORA applies to 20 types of EU financial entities, including credit institutions, payment and e-money institutions, investment firms, insurers, crypto-asset service providers and fund managers, and to ICT third-party service providers. Some small entities, such as insurance intermediaries that are SMEs, are excluded.Financial entities apply the rules in proportion to their size, risk profile and the nature, scale and complexity of their services.Choose a package for financial servicesCoverage and incident response commitments

What are the DORA incident reporting deadlines?

For a major ICT-related incident, the initial notification is due within four hours of classifying it as major and no later than 24 hours after becoming aware of it. The intermediate report is due within 72 hours of the initial notification, and the final report no later than one month after the latest intermediate report.The deadlines come from Commission Delegated Regulation (EU) 2025/301. Some entities may report by noon the next working day when a deadline falls on a weekend or bank holiday.Security operations responsibilitiesWhat a SIEM does

What is the DORA register of information?

It is a register that every financial entity keeps on all its contractual arrangements for ICT services from third-party providers, distinguishing those that support critical or important functions. Entities report on it to their competent authority at least yearly and make the full register available on request.Supported integrations and operating scopePrivacy and data handling

Can Vigilbase make us DORA compliant?

No. DORA keeps responsibility with the financial entity and its management body. Vigilbase OS helps you produce evidence: it keeps logs and events auditable in one place, and its investigations record the evidence, the actions taken and the verification.Default log retention is set per dataset, typically 30 to 90 days, so check it against your own logging procedures.Get started with Vigilbase OSHow agentic cybersecurity works

Related Topics

Security Basics

What is SIEM?

Compliance & Governance

Which Managed Cloudflare tier should a financial services team buy?

Compliance & Governance

PCI DSS 6.4.3 and 11.6.1

Compliance & Governance

NIS2 in Portugal

Get Started

Ready to Improve Your Security?

Our team can help you implement the security measures discussed in this guide. Get expert guidance tailored to your organization.
Get started Continue Learning