About DORA

The broadest pillar. Financial entities must maintain a comprehensive ICT risk management framework approved at board level. This covers governance and accountability, ICT asset identification, protection and prevention controls, anomaly detection, incident response and recovery, backup and restoration, and a continuous learning and improvement cycle.

Entities must establish a structured process for detecting, managing, and classifying ICT incidents. Major incidents must be reported to the relevant competent authority using standardised templates and timelines (initial notification, intermediate report, final report). Significant cyber threats may be voluntarily notified.

Entities must run a programme of regular resilience tests proportionate to their size and risk profile. Significant entities are additionally required to conduct Threat-Led Penetration Testing (TLPT) at least every three years, carried out by certified external testers.

Entities must adopt a strategy for managing ICT third-party risk, maintain a register of all ICT service arrangements, conduct due diligence before and during contracts, and ensure contracts include mandatory provisions on access rights, audit rights, service levels, and exit strategies. The regulation also establishes an Oversight Framework under which the ESAs can designate critical ICT third-party providers and subject them to direct supervisory oversight.

Financial entities may voluntarily participate in cyber threat information and intelligence sharing arrangements. DORA creates the legal basis for such schemes and encourages competent authorities to facilitate them.