DORA is the EU regulation that sets common rules for how financial entities manage ICT risk, report incidents, test their resilience and oversee technology suppliers. It has applied since 17 January 2025. Its terms are defined in Article 3 of Regulation (EU) 2022/2554, and a handful of them drive most of the daily work.
Who does DORA cover?
Article 2 lists the entities in scope. It includes credit institutions, payment and electronic money institutions, investment firms, crypto-asset service providers, central securities depositories, trading venues, insurance and reinsurance undertakings, credit rating agencies and crowdfunding service providers. It also lists ICT third-party service providers. Article 2(3) excludes certain entities, such as small occupational pension schemes and some insurance intermediaries. The text calls the covered group "financial entities."
The glossary
Digital operational resilience. A financial entity's ability to build, assure and review its operational integrity and reliability, including during disruptions.
ICT risk. Any reasonably identifiable circumstance tied to network and information systems that could compromise their security or cause adverse effects. In daily terms: anything in your technology that could hurt service or data.
ICT asset. A software or hardware asset in the network and information systems the entity uses. Your inventory should be built from this term, and it includes the libraries inside your applications.
ICT third-party service provider. An undertaking providing ICT services. The recitals say the idea covers providers of cloud computing, software, data analytics and data centre services, among others. A SaaS vendor is almost certainly one.
Critical or important function. A function whose disruption would materially impair the entity's financial performance, soundness or continuity, or its ability to meet its authorisation conditions. Many obligations scale with this label, so mapping your functions comes first.
Major ICT-related incident. An incident with a high adverse impact on the systems that support critical or important functions. Only these trigger the formal reporting duty, and the thresholds are set in separate delegated acts.
ICT concentration risk. Exposure to one or more related critical ICT providers that creates a dependency strong enough to endanger critical functions or financial stability. If one cloud region or one vendor going down would stop you, that is concentration.
Threat-led penetration testing (TLPT). A framework that mimics the tactics, techniques and procedures of real threat actors to test critical live production systems. The recitals describe it as more advanced testing for mature entities.
What to do
- Decide whether you are a financial entity under Article 2 or a supplier to one.
- List your critical or important functions and the systems behind each.
- Build an ICT asset inventory that includes software components, not just servers.
- Map every third-party provider to the functions it supports.
- Mark single points of dependency as possible concentration risk.
- Write an incident classification rule that makes the "major" decision fast.
- Ask suppliers what evidence they can give you about their own controls.
- If you are a supplier, expect questionnaires that use these exact terms, and prepare consistent answers.
Quick check
When did DORA start to apply?
Article 64 states that it applies from 17 January 2025.
Is a software vendor an ICT third-party service provider?
In most cases yes. The recitals say the category includes providers of software, cloud computing and data analytics, though you should confirm the details of your own contracts.
Sources
- Regulation (EU) 2022/2554 (DORA) on EUR-Lex, fetched 18 October 2026 (Articles 2 and 3 and recitals).
- DORA Article 64 text, fetched 18 October 2026.
The definitions above are paraphrased. For legal use, quote the regulation itself.
Last reviewed: 18 October 2026.
