DORA Compliance: Prepare Your Business with These 5 Key Pillars

DORA is the EU regulation on digital operational resilience for the financial sector. It sets out how financial entities in the European Union must manage ICT risk, report incidents, test their resilience and oversee their technology providers.

This practical guide sums up what the regulation requires and how to get compliant. It is written for the risk, compliance and security teams who have to put it into practice.

When it applies

From that date DORA is mandatory for the main players in the European financial sector. It builds on European and international good practice in cyber and operational resilience.

Who it affects

• Credit institutions
• Payment institutions
• Investment firms
• Insurers and reinsurers
• Credit rating agencies
• Crypto-asset service providers
• Crowdfunding service providers
• Fintechs
• Financial system providers
• The whole financial services industry

What's in the guide

1. What DORA isThe aim of the regulation, when it takes effect and which organisations are in scope.
2. The 5 pillarsICT risk management, incident management, digital operational resilience testing, ICT third-party risk and threat intelligence sharing.
3. How to comply with DORAThe 7 points to address, from the risk management framework to recording and sharing information on cyberattacks.
4. Action checklistA table of what to do for each point, so you can check where your organisation stands.

Standards that help you comply

The guide maps DORA to ISO 27001, ISO 27005, ISO 31000, ISO 22301, ISO 22313 and ISO 22317, the GDPR, the Spanish LOPDGDD and the NIS2 Directive. If you already work with any of them, you are a good part of the way there.