DORA, the EU Digital Operational Resilience Act, applies from 17 January 2025 and does not end with an audit. Its articles ask for ongoing detection of anomalies, yearly review of the risk framework, regular testing of continuity and backups, and staged incident reporting. Continuous monitoring is the evidence that these keep happening.
This is an explainer of Regulation (EU) 2022/2554. DORA is a regulation, not a certification, and Safeguard does not claim to make anyone compliant.
What does the text say must keep running?
Framework review (Article 6). The ICT risk management framework must be documented and reviewed at least yearly, with internal audit for entities that are not microenterprises.
Inventory (Article 8). Entities identify and classify ICT supported functions, assets and dependencies, keep inventories and assess legacy systems at least yearly.
Detection (Article 10). Mechanisms must promptly detect anomalous activity, incidents and potential single points of failure. They need alert thresholds and must be regularly tested.
Response and recovery (Articles 11 and 12). Continuity plans are tested at least yearly. Backup policies and restoration procedures are tested periodically, and restoration uses segregated systems.
Learning (Article 13). Major disruptions lead to post incident reviews, yearly reporting from senior ICT staff to the management body, and security awareness training for all staff.
Testing (Articles 24 and 25). Non-micro entities keep a risk based testing programme run by independent parties. Listed tests include vulnerability assessments and scans and open source analyses, with source code reviews where feasible.
What reporting clock does an incident start?
Article 19 sets staged reporting of major incidents: an initial notification, intermediate reports and a final report. The timing sits in Commission Delegated Regulation (EU) 2025/301. As summarised by Advisera, the initial notification is due within 4 hours of classifying the incident as major and within 24 hours of becoming aware of it. The intermediate report is due within 72 hours of the initial one, and the final report within one month of the intermediate report. Confirm the figures in the Official Journal text before you build runbooks on them.
Monitoring matters here because the clock depends on knowing when you became aware.
What does a monthly rhythm look like?
Treat the articles as a calendar.
Weekly: review alerts raised by your detection mechanisms and record who looked and what they decided.
Monthly: re-export your asset inventory, scan results and open vulnerability ages. Check that third party services in your register have not changed. Run a restore test on one system and keep the log.
Quarterly: walk through one incident scenario and time how long classification would take.
Yearly: review the framework, run the continuity test, report to the management body and refresh training.
Dated exports are easier to defend than memory. If a regulator asks what you did in March, a folder of monthly outputs answers it.
Where can tooling help?
Automation fits the repeatable parts: scheduled inventory exports, recurring vulnerability and dependency scans, alert routing with timestamps and a record of who acknowledged each alert. It does not replace judgment on classification, management body review or the content of your contracts.
What to do
- Map each article above to an owner and a frequency.
- Schedule inventory and scan exports so each month produces a dated file.
- Set alert thresholds and test them on a calendar.
- Add a restore test to the monthly checklist and keep the output.
- Write the incident clock into your runbook after checking the Official Journal text.
- Brief the management body yearly and keep minutes.
Quick check
Is DORA a certification?
No. It is an EU regulation that financial entities must meet, and supervisors check compliance. No product can certify you.
When did DORA start to apply?
Article 64 says it applies from 17 January 2025.
Sources
Last reviewed: 18 October 2026.
