If you are the first security hire at an EU financial firm, treat DORA as four workstreams: ICT risk management, third-party risk, resilience testing and incident reporting. In your first 90 days, build the inventory, find the vendor contracts, rehearse one incident report and write down what is missing.
What is DORA in one paragraph?
The Digital Operational Resilience Act is an EU regulation that has applied since 17 January 2025. According to EIOPA it covers 20 types of financial entities and their ICT third-party service providers. Its aim is that firms can withstand, respond to and recover from ICT disruption, from cyberattacks to plain system failures.
What are the four areas?
EIOPA lists them: ICT risk management, ICT third-party risk management, digital operational resilience testing (basic and advanced), and ICT related incidents. The regulation also makes the firm's management body responsible for the ICT risk framework, so you will need a senior sponsor and a way to report upward.
Days 1 to 30: find out what exists
You cannot manage risk on systems nobody listed. Start with three lists.
- Business functions and the ICT systems that support them.
- Vendors, and which functions each one supports.
- Existing incident procedures, even informal ones.
Constructed example: you find 140 SaaS tools, of which 9 support payments or customer accounts. Those nine get attention first. The other 131 get a lighter review.
Ask procurement or legal for the register of information, if one exists. The regulation requires financial entities to keep a register of contractual arrangements with ICT providers. If it lives in a spreadsheet owned by three people, that is a finding, not a failure on your part.
Days 31 to 60: test the paths that matter
Run a tabletop for one realistic incident, such as a vendor outage that stops customer logins. Time how long it takes to decide whether the event is major, who tells whom, and where the evidence sits. The technical standards under DORA set the content and timelines of notifications, so confirm the current versions with your compliance officer and use them in the exercise.
Also check backups by restoring one, not by reading the policy. A restore that works is stronger evidence than a policy that says it should.
Days 61 to 90: write the gap list
Produce one page for the management body. For each of the four areas, give a status, the top two gaps, an owner and a date. Avoid scoring everything green or red. Executives respond better to three specific gaps than to a heat map of forty.
Include your software supply chain. Application code arrives with dependencies you did not write. A dependency inventory and vulnerability scan gives you evidence for the risk management pillar. Safeguard offers SBOM generation and dependency scanning with reachability analysis, so you can separate vulnerable packages that your code actually calls from those it does not.
What to do
- Get the current list of critical or important functions from the business.
- Build the ICT asset and vendor lists and link them.
- Locate and review the register of information.
- Run one incident tabletop and record the timings.
- Restore one backup end to end.
- Present a short gap list with owners to the management body.
Quick check
Is DORA the same as the DORA metrics for engineering?
No. The DevOps Research and Assessment metrics measure delivery speed. The Digital Operational Resilience Act is an EU law on financial sector resilience.
Do I need a DORA certificate for my firm?
No official DORA certificate exists. Supervisors expect you to meet the regulation and show evidence when asked.
Sources
Last reviewed: 18 October 2026.
