European Union — DORA

DORA (Digital Operational Resilience Act) Compliance

DORA has applied identically across all EU member states for financial entities since January 17, 2025, and is now entering its first real supervisory enforcement cycle. Cyberox helps financial entities and their critical ICT third-party providers close remaining gaps.

Request a DORA Readiness Assessment → Talk to an Expert

Last reviewed: September 2026. Verify current requirements against the official regulator before acting — sources linked below.

Jan 2025

Applicable across the EU

2026

First supervisory enforcement cycle

Core pillars

~50%

Institutions reported at full readiness by original timeline

Regulatory Landscape

What This Framework Requires

🏦

Who Is In Scope

DORA applies to a broad range of financial entities — banks, insurance and reinsurance companies, investment firms, payment and e-money institutions, crypto-asset service providers — and to their critical ICT third-party service providers, including cloud and technology vendors.

📋

ICT Risk Management

DORA requires a comprehensive ICT risk-management framework covering governance, identification of ICT risk, protection and prevention, detection, response and recovery, and continuous learning and improvement.

🚨

Incident Reporting

Financial entities must classify and report major ICT-related incidents to regulators within defined timeframes, with harmonized reporting formats across the EU.

🧪

Digital Operational Resilience Testing

DORA requires regular testing of ICT systems, with more sophisticated entities required to undergo threat-led penetration testing (TLPT) on a recurring basis.

🔗

Third-Party ICT Risk

DORA introduces a formal Register of Information for ICT third-party providers and, for the most critical providers, a direct EU oversight regime — reflecting how central cloud and technology vendors have become to financial-sector operations.

⚠️

Verify Before You Commit

Regulators are now moving into active supervisory enforcement of DORA, with reported gaps between claimed and actual readiness across the industry. Confirm your specific obligations and current enforcement posture with your national competent authority or legal counsel.

How Cyberox Helps

DORA Readiness & Compliance Services

With regulators now actively supervising DORA compliance, we help financial entities and their ICT vendors close the gap between paper policies and demonstrable operational resilience.

✓
DORA Gap Assessment — Assessment against DORA's five core pillars — ICT risk management, incident reporting, resilience testing, third-party risk, and information sharing.
✓
ICT Risk Management Framework — Building or maturing the governance, risk-identification and response/recovery framework DORA requires.
✓
Register of Information Support — Structuring and maintaining the ICT third-party Register of Information DORA mandates.
✓
Resilience Testing Program — Designing a testing program appropriate to your entity's risk profile, including preparation for threat-led penetration testing where applicable.
✓
Third-Party ICT Risk Assessment — Vendor risk assessment methodology aligned with DORA's third-party risk-management requirements.

Request a DORA Readiness Assessment

DORA — 5 Pillars

1ICT Risk Management

2ICT-Related Incident Reporting

3Digital Operational Resilience Testing

4Third-Party ICT Risk Management

5Information & Intelligence Sharing

Enforcement Now Active

2026 marks DORA's first genuine supervisory enforcement cycle, following reported readiness gaps industry-wide.

FAQs

European Union — DORA Compliance — Common Questions

Who does DORA apply to?+

DORA applies to a broad range of EU financial entities — banks, insurance and reinsurance companies, investment firms, payment and e-money institutions, and crypto-asset service providers — as well as their critical ICT third-party providers, including cloud and technology vendors serving the financial sector.

When did DORA become applicable?+

DORA has applied identically across all EU member states since January 17, 2025. As of 2026, regulators are moving into their first genuine supervisory enforcement cycle, with reported gaps between industry-wide claimed readiness and actual compliance.

What is the DORA Register of Information?+

It is a formal register that in-scope financial entities must maintain, documenting their contractual arrangements with ICT third-party service providers. The most critical ICT providers can additionally be designated for direct EU-level oversight.

Does DORA require penetration testing?+

DORA requires regular testing of ICT systems, and more sophisticated financial entities must undergo threat-led penetration testing (TLPT) on a recurring basis — a more advanced, intelligence-driven testing approach than a standard vulnerability scan or basic pen test.

Related Services & Frameworks

🇪🇺

NIS2 Compliance

The EU's broader cybersecurity directive — relevant if you also fall under NIS2's essential/important sector scope.

Learn more →

⚡

Penetration Testing

Technical testing services that can be scoped toward DORA's resilience-testing requirements, including TLPT preparation.

Learn more →

🤝

Third-Party Risk Assessment

Vendor and supplier risk assessment methodology applicable to DORA's ICT third-party risk pillar.

Learn more →

Ready for a DORA Readiness Assessment?

Understand where your organization stands against DORA's five pillars as EU regulators move into active supervisory enforcement.

Request a DORA Readiness Assessment Talk to an Expert