DORA in one page

The Digital Operational Resilience Act sets uniform requirements for the ICT risk of financial entities across the EU. It pulls what were scattered expectations into one framework.

Its pillars are ICT risk management, incident classification and reporting, resilience testing, and oversight of third-party providers. The last of these — managing critical outsourced dependencies — is where many firms have the most work.

For compliance and risk teams, the practical starting point is a register of ICT dependencies and a clear incident-reporting path. Structured CPD on DORA helps teams speak the same language before the testing obligations bite.