Unifying Digital Resilience Across Europe
In our previous blog series, we explored the EU AI Act, a regulation shaping the responsible use of artificial intelligence. Now, we turn to another key legislative milestone that came into effect in 2025: the Digital Operational Resilience Act (DORA). This regulation is set to reshape the financial sector by strengthening its ability to withstand digital disruptions.
In today’s rapidly evolving digital landscape, financial institutions are undergoing extensive digital transformation, making them increasingly reliant on technology. While this brings efficiency and innovation, it also exposes them to an unprecedented array of cyber threats that can compromise operational integrity, customer trust, and even national security. Recognizing the critical need for a unified and robust defence mechanism, the European Union introduced DORA. More than just a harmonization of fragmented regulations, DORA establishes a comprehensive resilience framework designed to strengthen the financial sector against cyber risks and IT failures, as well as build digital trust among customers.
Understanding DORA: A Harmonised Approach
DORA represents a significant shift in how digital operational resilience is approached within the EU financial landscape. By harmonizing regulations across member states, DORA ensures that all financial entities and service providers operating within the EU adhere to a consistent set of rules designed to mitigate cyber risks and enhance operational stability. This unified approach is essential in reducing vulnerabilities that could be exploited by cybercriminals, ensuring that all actors in the financial sector, regardless of location, follow the same resilience standards.
Broader Context: A Global Perspective
While DORA is specific to the EU, its principles resonate globally. In the United States, similar efforts are underway to bolster the financial sector’s resilience through guidelines issued by the Federal Financial Institutions Examination Council (FFIEC) and the Office of the Comptroller of the Currency (OCC). In Asia, countries like Singapore have implemented the Cyber Hygiene Notice and the Technology Risk Management (TRM) guidelines. These efforts underscore a worldwide recognition of the need for robust digital operational resilience frameworks.
Scope of DORA: Who is Affected?
The Digital Operational Resilience Act has a broad and inclusive scope, applying to a wide range of entities within the European Union’s financial sector. Its provisions cover traditional financial institutions such as banks, insurance companies, investment firms, payment institutions, and electronic money institutions. Additionally, DORA extends its reach to emerging financial entities like crypto-asset service providers, crowdfunding platforms, and alternative investment fund managers. Importantly, the regulation also includes third-party ICT (Information and Communication Technology) service providers that support financial institutions, with stricter requirements for those classified as critical such as cloud service providers or data centres. By encompassing both established and newer market participants as well as their ICT partners, DORA ensures comprehensive oversight and harmonization of digital resilience practices across the EU financial ecosystem. DORA entered into force on January 17, 2025. From this date, financial institutions and relevant third-party service providers must comply with its provisions
Proportionality in Practice
A key feature of DORA is its application of the principle of proportionality. This means that the stringent requirements of DORA are tailored to fit the size, risk profile, and complexity of each financial entity. For instance, a multinational bank with vast digital operations will face different challenges and therefore different regulatory expectations compared to a small regional credit union. This flexibility is designed to prevent the regulatory burden from stifling smaller entities while ensuring robust protections are in place where needed.
Bringing Resilience to the Boardroom
For many organizations, adapting to DORA means more than just compliance – it requires a fundamental shift in how digital resilience is managed. DORA has become a board-level agenda item, prompting financial institutions to develop dedicated programs that integrate resilience strategies into their core operations. This top-down approach ensures that digital resilience is prioritised at the highest levels of governance, fostering a culture of proactive risk management.
The Core Components of DORA
DORA’s framework can be broken down into 5 core components that address the comprehensive needs of the financial sector:
- ICT Risk Management
Financial entities must establish and maintain a sound, comprehensive, and well-documented ICT risk management framework. This includes clear protocols for identifying, assessing, and mitigating risks, as well as contingency plans to ensure operational continuity during ICT-related disruptions. The framework should be reviewed regularly to stay aligned with evolving cyber threats.
- Third-Party Risk Management
As financial institutions become more dependent on third-party service providers, DORA enforces strict oversight to mitigate associated risks. Organizations are required to maintain an up-to-date register of all contracted ICT service providers, ensuring transparency and accountability. They must also assess the cyber resilience of these providers and verify compliance with DORA’s security standards to safeguard against potential vulnerabilities. Additionally, to prevent systemic risks, financial entities should avoid excessive reliance on a single provider for critical functions, ensuring greater operational stability and resilience.
- Incident Reporting
DORA mandates financial entities to systematically record all ICT-related incidents and significant cyber threats, implement proactive detection mechanisms (e.g., early warning indicators), and establish structured procedures to track, log, and categorise incidents by severity and priority. Roles and communication plans must be defined for incident response, with major incidents escalated to senior management. Entities must also report critical incidents to authorities using standardised templates and timelines to ensure compliance.
- Digital Operational Resilience Testing
Regular testing of digital resilience measures is essential for identifying weaknesses before they can be exploited. DORA requires financial entities to conduct comprehensive testing that includes penetration tests, vulnerability assessments, and scenario-based exercises.
- Information Sharing for Collective Cybersecurity
Collaboration is a key defence mechanism in cybersecurity. DORA promotes the exchange of cyber threat intelligence among financial institutions, regulators, and other stakeholders. Sharing information about vulnerabilities, attack techniques, and security measures helps strengthen the sector’s collective resilience and response capabilities.
Actionable Insights for Financial Entities
To support financial entities in strengthening their digital operational resilience, here are essential best practices aligned with DORA’s principles.
- Enhance Board Involvement
Ensure that digital resilience is a priority at the board level. Regular updates and training can equip board members with the knowledge needed to make informed decisions.
- Develop a Comprehensive ICT Risk Management Framework
Tailor your risk management framework to account for your organization’s specific risk profile and operational complexity. This framework should be dynamic, with regular updates reflecting emerging threats.
- Strengthen Third-Party Oversight
Implement rigorous due diligence processes for third-party service providers, ensuring that their resilience measures are on par with your organizational standards.
- Promote a Culture of Resilience
Foster an organizational culture that prioritises resilience at every level. This includes regular training, awareness programs, and encouraging cross-departmental collaboration.
- Leverage Information Sharing
Participate in industry forums and information-sharing initiatives to stay informed about the latest threats and best practices.
Conclusion: Contemporary Challenges and Opportunities
DORA’s implementation comes at a time when the digital landscape is in flux, with emerging technologies such as artificial intelligence and blockchain reshaping financial services. While these innovations offer unprecedented opportunities for efficiency and growth, they also introduce new vulnerabilities. DORA provides a structured approach to navigating these challenges, ensuring that financial entities can harness technological advancements without compromising security, while fostering collective collaboration to build systemic resilience.
Stay tuned for more insights as we continue to explore the latest trends shaping the future of finance, and feel free to book an appointment with our expert anytime.