Do EU regulators check every IT supplier directly?

No. Only IT suppliers named as critical are checked directly by EU financial regulators. Others still face checks and contract terms from their financial customers.

Can we finish DORA as a one-off project?

No. DORA needs ongoing risk reviews, incident handling, testing and supplier checks. Your supplier list and test results must stay current as your systems change.

What is the register of information?

It is the list of your IT suppliers and contracts, kept in the format DORA requires. We help you build it and keep it up to date.

When did DORA start to apply?

DORA has applied since 17 January 2025 to the financial firms it lists. As an EU regulation, it applies directly in every EU country.

Does DORA apply to crypto firms?

Yes, once they hold a MiCA licence. Licensed crypto service providers are among the financial firms DORA lists.

What are DORA’s five pillars?

DORA groups its rules into five areas. They are managing IT risks, handling and reporting serious incidents, testing your systems, managing the risk from IT suppliers and sharing threat information. Sharing information with other firms is voluntary.

What are DORA’s incident reporting deadlines?

Major IT incidents are reported to your regulator in three stages. The initial notification is due within 4 hours of classifying the incident as major, and at most 24 hours after you learn of it. If you only classify it as major after those 24 hours, you have 4 hours from that point. The intermediate report follows within 72 hours of the initial notification, and the final report within a month of the latest intermediate report. Commission Delegated Regulation (EU) 2025/301 sets these time limits.

EU financial sector regulation

DORA requirements for financial operational resilience

DORA, the Digital Operational Resilience Act, is an EU law requiring financial firms to manage IT risks, recover from disruptions and oversee IT suppliers. It has applied since 17 January 2025, and its rules also reach those suppliers.

Discuss DORA support See our DORA audit service

Type: EU regulation
Applies from: 17 January 2025
Financial coverage: 20 types of financial firm
IT suppliers: Through contracts; critical ones checked directly

Who it applies to

Financial firms and technology suppliers

Banks, payment institutions and e-money institutions.
Insurers, investment firms and licensed crypto service providers.
IT suppliers through their financial customers’ contracts, and critical suppliers that EU financial regulators check directly.

Some exclusions apply, certain small firms follow lighter rules, and IT suppliers have different duties from financial firms.

Dates to plan for

When DORA began to apply

17 January 2025
DORA duties began applying to the financial firms it lists.

What it asks of you

Run and check your IT safeguards

Assign IT risk decisions
Management oversees the risks, policies and people responsible for systems supporting your financial services.
Know what your services rely on
Record which systems and suppliers support services that cannot stop.
Handle and report incidents
Set rules for judging serious IT incidents, recording what happened and telling your regulator.
Exercise your recovery plans
Test backups and recovery procedures, then fix the problems those tests reveal.
Oversee your IT suppliers
Maintain the required supplier list, review contracts and plan how to leave a provider when necessary.
Prepare for advanced attack tests
Regulators can require some financial firms, chosen for their size, importance and IT risk, to test their systems with realistic simulated attacks.

How we help

Assess DORA compliance and address the gaps

We assess your ICT risk management and operational resilience against DORA, then turn findings into a prioritised plan. We help your team implement agreed improvements and establish ongoing oversight.

DORA Compliance & ICT Risk AssessmentAssess DORA compliance and ICT risk, then prioritise the improvements your organisation needs. CISO-as-a-ServiceA senior security lead to plan the work, guide your teams and report to your board. Fintech licensing: IT and securityIT and security support from licence preparation through regulatory review to ongoing operations.

Common questions

Related regulations and standards

NIS2
For the financial firms it covers, DORA takes the place of NIS2’s security and incident reporting rules. Group companies outside DORA should still check whether NIS2 applies to them.
MiCA
A crypto firm licensed under MiCA becomes one of the financial firms DORA lists, so DORA’s IT rules start on the day it is licensed.

Free 30-minute call

Plan the next stage of your DORA work

Discuss your regulator’s requests and current IT risks in a free 30-minute call.

Discuss DORA support hello@guardera.tech