The DORA regulation marks a crucial turning point for IT security in companies of the financial sector. Designed to strengthen operational resilience against growing cyber threats, this new piece of European legislation imposes strict requirements on ICT risk management, the oversight of third-party providers and resilience testing. In this article, we explore how it has evolved, the key changes it brings and its impact on company compliance, now that the regulation has applied since 17 January 2025.
Understanding the evolution of the DORA regulation
Origins of DORA: context and initial objectives
The Digital Operational Resilience Act (DORA), introduced by the European Commission, aims to strengthen the digital operational resilience of financial-sector companies within the European Union. The regulation comes at a time when growing dependence on information and communication technologies (ICT) exposes these entities to significant risks, particularly cyber threats and operational disruption.
As digital threats have evolved, the need to strengthen the security of IT systems and the business continuity of financial companies has become crucial. The regulation was designed to create a harmonised legislative framework at European level, ensuring that every financial entity has the capabilities it needs to withstand major operational incidents and recover from them quickly.
Main stages in the development of DORA since 2020
Work on DORA began in 2020, in response to the rapid evolution of the digital landscape and to the weaknesses observed in IT risk management within financial institutions. Here are the key stages:
- 2020: Initial proposal by the European Commission.
- 2022: Adoption of the text by the European Parliament and the Council of the European Union.
- 16 January 2023: Entry into force of the regulation, followed by the drafting of the regulatory and implementing technical standards by the European supervisory authorities.
- 17 January 2025: Application of the regulation: every financial entity concerned must comply with DORA’s requirements.
These stages reflect the European Union’s clear intention to strengthen financial stability by creating common rules for ICT risk management in the financial sector.
Comparison with previous regulations (NIS, GDPR, etc.)
Before DORA, other regulatory frameworks had been put in place to protect critical infrastructure and personal data. The most notable are the NIS Directive (Network and Information Security) and the GDPR (General Data Protection Regulation).
- NIS Directive: Centred on the security of networks and information systems for critical infrastructure, but with a more general focus, without specifically addressing the requirements of the financial sector.
- GDPR: Concentrates on the protection of personal data, with obligations on data management, but without addressing operational resilience in any depth.
DORA stands apart by specifically targeting ICT-related risks in financial services and by strengthening operational resilience at the digital level. The regulation introduces clear obligations on risk management, the oversight of third-party providers and resilience testing, and so goes beyond the requirements of the earlier regulations.
The key changes brought by DORA
Stronger requirements for ICT risk management
DORA requires financial entities to strengthen their management of ICT-related risks. This includes:
- Continuous risk assessment: Companies must identify, assess and manage ICT risks proactively, building these processes into their existing risk management policies.
- Planning corrective measures: In the event of an incident, clear action plans must be in place to restore operations quickly.
- Monitoring and reporting: Companies must put in place processes for regular monitoring of, and reporting on, the state of their ICT systems and the management of the associated risks.
These requirements aim to ensure that financial companies are better prepared to deal with cyber threats and the other risks that come with digital transformation.
New obligations for incident management and resilience testing
One of DORA’s major contributions is the introduction of strict obligations on incident management and operational resilience testing:
- Notification of major incidents: Entities must promptly notify major ICT incidents to the competent authorities. This covers cyberattacks, system failures and any other disruption with a significant impact on operations.
- Operational resilience testing: DORA requires companies to carry out resilience tests regularly, such as incident simulation exercises, to assess their ability to withstand disruptions and recover from them.
- Business continuity plans: Companies must have robust plans to keep their activities running in the event of an incident, keeping service interruptions to a minimum.
These new obligations strengthen companies’ ability to anticipate ICT incidents and respond to them effectively, reducing the potential impact on their operations.
Closer oversight of critical subcontractors and suppliers
DORA places particular emphasis on the management of third-party providers, especially providers of critical ICT services such as cloud services. Financial companies must now:
- Assess and monitor suppliers: Critical providers must be assessed regularly to make sure they meet the security and resilience standards imposed by DORA.
- Use contracts with specific clauses: Contracts with suppliers must include precise clauses on risk management, service continuity and incident notification.
- Carry out regular audits: Companies must audit their providers regularly to make sure they comply with DORA.
This closer oversight aims to reduce the risks linked to outsourcing and to ensure that critical suppliers do not compromise companies’ operational resilience.
How DORA has evolved to adapt to cyber risks
Taking account of changing threats and technologies
The cyber threat landscape is constantly changing, and DORA was designed to adapt to these changes. The regulation takes into account:
- Changing cyber threats: DORA covers the latest threats, such as ransomware, DDoS attacks and digital espionage, and imposes measures to guard against them.
- Emerging technologies: The regulatory framework encourages the use of cutting-edge technologies, such as artificial intelligence, to strengthen threat detection and resilience.
- Continuous innovation: Companies are encouraged to adopt technological innovations to keep pace with new threats and improve their security.
In this way, DORA ensures that financial companies are equipped to face current and future digital threats.
Building in cybersecurity best practices and standards
To guarantee optimal security, DORA builds in several international cybersecurity best practices and standards:
- Adoption of recognised standards: The regulation encourages the adoption of standards such as ISO 27001, NIST and other cybersecurity standards.
- Implementation of best practices: DORA recommends practices such as data encryption, multi-factor authentication, and identity and access management.
- Continuous training: Companies must train their staff regularly in security best practices to strengthen their defences against cyberattacks.
By building in these standards and practices, DORA aims to raise the level of IT security in financial-sector companies.
Flexibility to adapt to future changes
DORA was designed with a flexibility that allows it to adapt to future technological developments and threats:
- Adjustment clauses: The regulation provides for clauses that allow requirements to be adjusted as the digital landscape evolves.
- Periodic assessments: The competent authorities will carry out periodic assessments to make sure DORA remains relevant in the face of new threats.
- Revisions and updates: The text of the regulation can be revised to include new measures in line with technological advances or new cyber threats.
This flexibility ensures that DORA will go on protecting financial companies effectively against emerging risks.
The impact of DORA’s evolution on compliance
Continuous adaptation of compliance programmes
With DORA now in application, financial companies must adapt their compliance programmes in order to meet the new requirements:
- Updating internal policies: ICT risk management policies must be revised so that they include the new obligations.
- Strengthening controls: Companies must strengthen their internal controls to make sure they remain compliant with DORA on an ongoing basis.
- Training teams: Compliance teams must be trained in the new requirements to ensure that they are implemented effectively.
Adapting compliance programmes is essential to avoid penalties and to guarantee ongoing compliance with the regulation.
The role of supervisory authorities in applying DORA
DORA supervision works at two levels. The national competent authorities (in France, the ACPR, the prudential supervisor for banking and insurance, and the AMF, the financial markets authority, along with the ECB for significant banks) supervise financial entities. The European supervisory authorities (EBA, ESMA and EIOPA) specify the regulation’s requirements and oversee critical ICT third-party service providers:
- Supervision and controls: The national competent authorities check how financial entities implement DORA.
- Standards and guidelines: The European supervisory authorities draft the technical standards and guidelines that set out the obligations in detail.
- Penalties for non-compliance: The national competent authorities can impose administrative penalties and remedial measures on financial entities; critical ICT providers, for their part, fall under European oversight, which can impose periodic penalty payments on them.
The authorities’ role is to make sure that every company meets DORA’s requirements, in order to strengthen the stability of the financial sector.
Penalties and consequences of non-compliance
Penalties for non-compliance can be severe and include:
- Financial fines: Companies can be fined significant amounts if they do not meet DORA’s requirements.
- Restrictions on operations: In cases of serious non-compliance, the authorities can restrict some of the company’s operations or activities.
- Damage to reputation: Non-compliance can also lead to a loss of trust among customers and partners, affecting the company’s reputation.
These penalties underline the importance of proactive compliance with DORA to avoid negative repercussions.
Preparing for the future with DORA
Outlook for DORA in the medium and long term
DORA is designed to evolve over time, and several developments are expected in the medium and long term:
- Stronger requirements: ICT risk management requirements are likely to be strengthened to keep up with changing threats.
- New resilience tests: New forms of resilience testing could be introduced to better assess companies’ ability to withstand cyber threats.
- Extension of the framework: DORA could be extended to cover new technologies or new sectors, broadening its scope.
These developments aim to strengthen companies’ operational resilience further still, in a digital environment that never stops changing.
Opportunities offered by future versions of DORA
Future versions will offer opportunities for companies, including:
- Technological innovation: DORA encourages the adoption of new technologies to improve security and resilience.
- Closer collaboration: Companies will be encouraged to work more closely with their providers and partners to strengthen their collective resilience.
- Strategic positioning: Companies that comply quickly with new versions of DORA will be able to position themselves as leaders in cybersecurity.
These opportunities can help companies improve their competitiveness and their resilience in the face of digital challenges.
Tips for staying proactive as the regulation evolves
To stay proactive as DORA evolves, companies should:
- Keep track of developments: Set up regulatory watch mechanisms to keep an eye on regulatory updates and on new requirements.
- Train staff continuously: Make sure teams receive ongoing training in DORA’s new requirements and in cybersecurity best practices.
- Work with experts: Work with consultants or specialised services to guarantee optimal compliance.
These tips can help companies anticipate regulatory changes and keep their compliance with DORA up to date.
DORA represents a major change in the way financial-sector companies manage ICT-related risks. By complying with this regulation, companies can not only strengthen their operational resilience but also improve their IT security against growing cyber threats. Implementing DORA proactively is essential to guarantee business continuity and protect information systems in a digital environment that never stops changing.
