DORA
DORA stands for the Digital Operational Resilience Act, a European Union regulation designed to strengthen the digital operational resilience of financial entities and their critical ICT third-party service providers. It requires firms to manage ICT risk, report major ICT‑related incidents, test resilience, oversee ICT third‑party risk, and maintain stronger governance over technology‑dependent operations.
For IT, security, risk, and compliance teams, DORA raises expectations for reliable records, clear ownership, lifecycle visibility, and auditable evidence across ICT assets, information assets, and the services they support.
What is DORA?
DORA is an EU regulation (Regulation (EU) 2022/2554) that sets harmonized requirements for how financial entities manage digital operational resilience across the Union. It focuses on an organization’s ability to withstand, respond to, and recover from ICT‑related disruptions, including cyberattacks, system failures, service outages, data center incidents, and third‑party technology issues.
DORA applies to a wide range of financial entities such as banks, insurance and reinsurance undertakings, investment firms, payment institutions, electronic money institutions, central securities depositories, trading venues, and crypto‑asset service providers operating in the EU financial sector. It also introduces an oversight framework for certain critical ICT third‑party service providers that support those entities, including cloud and other technology providers.
While DORA is a financial-sector regulation, its requirements reach beyond compliance teams. IT, security, risk management, procurement, legal, operations, business continuity, and vendor management all contribute to DORA readiness.
Why DORA Matters
Financial organizations rely heavily on technology and information to serve customers, process transactions, manage portfolios, run payment services, and support day-to-day operations. When these environments are poorly governed, organizations may struggle to identify risks, respond effectively to incidents, recover services quickly, or demonstrate that appropriate controls are in place.
DORA raises the bar for how financial entities manage ICT risk and operational resilience by:
- Requiring a documented ICT risk management framework integrated into overall risk management.
- Mandating reporting of major ICT-related incidents to competent authorities within defined timelines.
- Introducing regular digital operational resilience testing for critical or important functions and the ICT systems that support them.
- Strengthening oversight of ICT third-party service providers, including contractual and concentration risk requirements.
- Emphasizing governance, accountability, and evidence around ICT assets, information assets, services, and providers.
For many firms, this means moving from ad hoc, siloed practices toward more integrated, measurable, and demonstrable controls across the ICT landscape.
When did DORA take effect?
DORA entered into application on 17 January 2025, following a two‑year implementation period after its adoption. From that date, in-scope financial entities must comply with the regulation, while designated critical ICT third-party service providers are subject to its oversight framework.
Main Requirements of DORA
DORA sets requirements across several areas of digital operational resilience. These requirements help financial entities manage ICT risk, respond to disruptions, and maintain stronger oversight of the technology and service providers they depend on.
ICT Risk Management
Financial entities must have a structured approach for identifying, managing, monitoring, and mitigating ICT risk. This includes governance, internal controls, protection measures, detection capabilities, response processes, recovery planning, and ongoing improvement.
ICT-Related Incident Reporting
Financial entities must classify and report major ICT-related incidents to the relevant authorities. DORA also introduces expectations around documenting incidents, assessing their impact, and communicating when required.
Digital Operational Resilience Testing
Financial entities must test their ability to withstand and recover from ICT disruptions. This may include vulnerability assessments, scenario-based testing, penetration testing, and other resilience exercises depending on the organization’s size, risk profile, and role in the financial system.
ICT Third-Party Risk Management
DORA requires stronger oversight of ICT third-party service providers. Financial entities must understand how external providers support their operations, manage related risks, and maintain appropriate contractual arrangements and monitoring practices.
Information Sharing
DORA permits financial entities to exchange cyber threat information and intelligence with one another, subject to applicable legal and regulatory requirements. This can help organizations strengthen awareness and improve their response to emerging threats.
DORA and ICT Assets
DORA defines an ICT asset as a software or hardware asset within the network and information systems used by a financial entity. These assets form part of the broader ICT environment that supports business operations and critical or important functions. For a deeper explanation, see the separate glossary entry for ICT Asset.
DORA and Information Assets
DORA defines an information asset as a collection of information, either tangible or intangible, that is worth protecting. Resilient operations depend not only on technology but also on the confidentiality, integrity, and availability of critical data and records. Information assets may include customer data, transaction records, financial reports, policy documents, contracts, and internal procedures.
DORA and IT Asset Management
IT Asset Management (ITAM) supports DORA readiness by helping organizations maintain clearer and more trustworthy records of the ICT assets used across the business. For financial entities, this means understanding:
- What ICT assets exist.
- Where they are located or hosted.
- Who they are assigned to and who is accountable for them.
- Which business services, processes, functions, or locations they support.
- What lifecycle stage they are in and whether they are still supported.
This visibility gives IT, security, risk, compliance, and operations teams a stronger foundation for risk reviews, incident investigations, recovery planning, vendor oversight, and audit support.
ITAM is primarily concerned with ICT assets, not information assets or data content. It does not classify or manage business information, set data‑retention rules, or control the content of files and databases. Instead, ITAM focuses on the technology resources that support, store, access, process, or transmit business information.
Teqtivity helps organizations centralize ICT asset records, connect assets to users and departments, track lifecycle activity, and maintain records that support governance and accountability under frameworks like DORA. ITAM alone does not make an organization DORA‑compliant, but it underpins many DORA‑related activities that depend on accurate, contextual ICT asset information.
Example of DORA in practice
A financial organization may rely on online banking systems, payment platforms, employee devices, cloud services, business applications, and third-party technology providers to operate.
Under DORA, the organization must manage the ICT risks associated with these systems and services. This includes identifying potential risks, maintaining controls, monitoring for issues, and preparing response and recovery plans.
If a major ICT-related incident occurs, the organization may need to classify the incident, assess its impact, document what happened, and report it to the relevant authority within the required timeframe.
The organization must also test its digital operational resilience. This may include vulnerability assessments, scenario testing, recovery exercises, penetration testing, or other activities that show whether critical systems and processes can withstand disruption.
For third-party ICT services, the organization needs to understand which providers support important operations, what risks they introduce, and whether the right contractual, monitoring, and governance arrangements are in place.
In practice, DORA requires financial entities to treat digital operational resilience as an ongoing discipline, not a one-time compliance project.
Why DORA Readiness Starts with Visibility
DORA readiness is difficult when ICT asset records are incomplete, outdated, or scattered across different tools.
Financial entities may have security tools, MDM platforms, service desks, HR systems, procurement records, and spreadsheets that each hold part of the asset picture. But when these records are disconnected, teams can struggle to understand what assets exist, who owns them, where they are, how they are used, and whether they are still active.
This creates problems during risk reviews, incident response, recovery planning, audits, and third-party assessments. Teams may lose time reconciling records instead of acting on reliable information.
ITAM helps create a centralized and dependable view of ICT assets. It brings asset details, ownership, lifecycle status, user assignments, locations, and supporting records into one place so teams can work from a clearer source of truth.
For DORA, this visibility gives organizations a stronger starting point for ICT risk management, resilience planning, evidence collection, and operational accountability.
Frequently Asked Questions about DORA
What does DORA stand for?
DORA stands for the Digital Operational Resilience Act. It is a European Union regulation focused on strengthening digital operational resilience across the financial sector.
Who does DORA apply to?
DORA applies to a wide range of EU financial entities, including banks, insurance and reinsurance undertakings, investment firms, payment institutions, crypto-asset service providers, and other regulated organizations in the financial sector. It also introduces oversight requirements for certain critical ICT third-party service providers.
Is DORA only a cybersecurity regulation?
No. DORA includes cybersecurity requirements but is broader, covering governance, ICT risk management, incident reporting, operational continuity, resilience testing, and third‑party oversight.
How does DORA relate to ICT assets and information assets?
DORA refers to both ICT assets and information assets as part of an organization’s digital operational resilience.
ICT assets are the technology resources used to support business operations. Information assets are the data, records, documents, and business information those operations depend on.
Why is asset ownership important under DORA?
Asset ownership helps teams understand who is responsible for each ICT asset.
When an asset needs to be reviewed, patched, recovered, investigated, retired, or reassigned, clear ownership helps reduce delays and confusion.
How can ITAM support DORA readiness?
ITAM supports DORA readiness by giving organizations the structure to manage ICT assets more consistently. It helps teams maintain accurate asset records, assign ownership, track lifecycle activity, connect assets to business context and vendors, and preserve evidence of asset-related actions that may support DORA compliance efforts.
How does Teqtivity help with DORA readiness?
Teqtivity gives teams a centralized platform for putting ITAM practices into action. It brings ICT asset data, user assignments, department ownership, lifecycle updates, vendor context, and supporting records into one place so IT, security, risk, and compliance teams can work from clearer, more reliable asset information.
For organizations preparing for DORA, this creates a stronger foundation for ICT asset visibility and operational resilience.
Glossary of Related Terms