First find out whether DORA applies to you directly or through a customer. It applies to financial entities in the EU, and those entities pass duties to their ICT suppliers by contract. Then spend 90 days on scope, a register of your own suppliers, an incident process, and evidence you can hand to a customer.
Does DORA apply to a startup?
The Digital Operational Resilience Act, Regulation (EU) 2022/2554, has applied since 17 January 2025. It covers financial entities such as banks, insurers and investment firms. A startup is covered directly if it is one of those, for example a licensed payment or e-money institution. If you sell software or cloud services to such a firm, you are an ICT third-party provider to it, and you will meet DORA through contract terms and questionnaires. Critical providers fall under a separate EU oversight framework. Whether you are in scope is a legal question, so get advice.
The regulation scales obligations to size and risk, and the recitals give lighter treatment to microenterprises.
What are the main areas?
DORA covers ICT risk management, reporting of major ICT incidents, digital operational resilience testing, sharing of cyber threat information, and ICT third-party risk management. Financial entities must keep a register of information on their contractual arrangements with ICT providers, under Article 28, using templates in Commission Implementing Regulation (EU) 2024/2956.
Days 1 to 30: scope and inventory
Decide your role. Write a one page statement of which customers are financial entities and which services they use. List your own critical systems and your own suppliers, including cloud, identity and source code tools. This is the data a customer's register will ask you for.
Days 31 to 60: process
Write an incident process with named roles, a severity scale and a way to inform customers quickly, since they have their own reporting clocks. Write down continuity and restore steps, then test one. Check contracts with your suppliers for notice, exit and subcontracting terms.
Days 61 to 90: evidence
Assemble a pack a customer can review: your inventory of third parties, your incident process, your test results, your access controls and your software component inventory. Keep it dated and owned. Run one tabletop on a supplier outage and record what changed.
What to do
- Ask counsel whether you are a financial entity or an ICT provider to one.
- List customers that are financial entities and the services they use.
- Build a register of your own critical suppliers with contract dates and exit terms.
- Write the incident process and the customer notification path.
- Run one restore test and one tabletop, and record results.
- Prepare a dated evidence pack and a named contact for customer reviews.
- Set a quarterly review so the pack does not go stale.
Where does Safeguard help?
An SBOM and a software inventory are useful evidence in a supplier review. Safeguard generates SBOMs and offers compliance automation. It does not certify DORA compliance, and your obligations remain yours.
What mistakes do startups make?
Assuming it does not apply. If a bank or payment firm is your customer, you will see DORA language in contracts and questionnaires, whether or not the regulation names you. Ask early.
Writing policies without testing them. An incident process that nobody has rehearsed will fail in the first hour. One tabletop beats ten pages.
Forgetting subcontractors. Your customer wants to know who you depend on. If your service runs on a cloud provider and a monitoring tool, both belong in your supplier list.
Treating the evidence pack as a one-off. Customers will ask again next year, and a stale pack is worse than none. Put the review date in the calendar.
Overclaiming. Say what you have done, and mark the rest as planned. Do not describe a plan as a control.
Quick check
Is DORA only for banks?
No. It covers a range of financial entities, and it reaches their ICT suppliers by contract.
What is the register of information?
A record of a financial entity's contracts with ICT third-party providers, kept under Article 28.
Sources
Last reviewed: 18 October 2026.
