Regulation (EU) 2022/2554 on digital operational resilience for the financial sector (Digital Operational Resilience Act, DORA) is an EU regulation which entered into force on 16 January 2023 and will apply from 17 January 2025.
DORA is a directly applicable EU legal act which aims to increase the digital operational resilience of the EU financial sector by strengthening the risk management and incident reporting systems of financial entities (such as banks, insurance undertakings, electronic money and payment institutions, investment firms, etc.), information and communication technology (ICT) and third parties.
DORA establishes a regulatory framework for digital operational resilience which requires all undertakings covered by this regulation to ensure the operational capacity to withstand, respond to and recover from all types of ICT-related disruptions and threats. These requirements are uniformly applied in all EU Member States and define ICT risk, establish rules on ICT risk management, incident reporting, operational resilience testing and ICT third-party risk monitoring. DORA is designed for 20 different types of financial entities and ICT and third-party service providers.
