DORA (Digital Operational Resilience Act)
An EU regulation establishing uniform requirements for the digital operational resilience of financial entities. DORA mandates comprehensive ICT risk management, incident reporting, resilience testing, and third-party risk oversight for banks, insurers, and their critical technology providers.
Why it matters
Financial services run on technology, and regulators have noticed. DORA creates a single, harmonized framework across the EU that replaces the patchwork of national guidelines. It applies not just to financial institutions but also to their critical ICT service providers, meaning technology vendors serving the financial sector face direct regulatory obligations for the first time. Non-compliance risks supervisory action, fines, and loss of operating licenses.
In practice
DORA compliance requires an ICT risk management framework, major incident classification and reporting within strict timelines, regular digital operational resilience testing (including threat-led penetration testing for significant entities), and a register of all ICT third-party arrangements with ongoing oversight. In vucavoid, DORA requirements can be tracked through baselines alongside other frameworks. Incident response tracking meets notification timelines, and third-party risk management addresses the ICT provider oversight provisions.