The DORA Regulation: What a Financial Entity Actually Has to Do

What DORA is

DORA is Regulation (EU) 2022/2554 of the European Parliament and of the Council of 14 December 2022 on digital operational resilience for the financial sector. The name stands for Digital Operational Resilience Act. It has applied since 17 January 2025.

The premise is straightforward. Finance runs on IT systems and on the suppliers of those systems, so digital resilience stops being an IT department concern and becomes part of financial stability. DORA puts responsibility for it on the management body, which in practice means the board.

Who it covers

The scope is broad and covers essentially the whole supervised financial market. In Poland the supervisor is the KNF. The rules apply to, among others:

• banks and credit institutions
• investment firms and brokerage houses
• insurance and reinsurance undertakings
• payment institutions and e-money institutions
• fund managers and pension funds
• crypto-asset service providers
• third-party ICT providers serving any of the above

That last entry catches people out. DORA reaches beyond the financial sector into the technology suppliers that serve it. If your company provides software or services to banks, the service-level and audit requirements will arrive through contracts whether or not you are a supervised entity yourself.

The five pillars

The requirements are usually grouped into five areas. The split is useful for planning, because each pillar needs different skills.

1. ICT risk management

You need a documented risk management framework: identifying assets and dependencies, protection, detection, response and recovery. Responsibility sits with the management body and cannot be delegated to a supplier. The board is also expected to keep its own knowledge of ICT risk current.

2. Incident reporting

You need a process for detecting, classifying and reporting ICT-related incidents. Classification criteria come from RTS 2024/1772, with reporting content and templates in RTS 2025/301 and ITS 2025/302 respectively. Deadlines are below.

3. Digital resilience testing

A testing programme is required, covering vulnerability scanning, security testing and scenario-based assessment. Significant entities additionally run threat-led penetration testing, or TLPT, on a three-year cycle. This is the area we cover through security assessments and pen testing.

4. Third-party risk

You need a register of ICT supplier contracts, due diligence before signing, and contractual terms on service levels, audit rights, incident notification and exit strategies. Providers designated as critical fall under oversight at European level.

5. Information sharing

This pillar is voluntary. DORA encourages participation in threat intelligence sharing arrangements between financial entities, subject to data protection and competition rules.

Major incident reporting deadlines

This is the most common question, so here it is concretely. Reporting a major ICT incident happens in three stages:

Four hours reads reasonably on paper and very differently at 2am on a Sunday. The hard part in practice is not the form, it is establishing within that window whether the incident even meets the major threshold. Without round-the-clock detection, for example through SOC-as-a-Service, that clock starts running before anyone has noticed the event.

What supervisors expect

Poland's KNF runs a dedicated DORA section, publishes Q&A material and specifies the reporting systems. A few practical points worth knowing:

• Incident reports are submitted electronically through systems designated by the supervisor
• The full set is expected: initial notification, intermediate report and final report
• The ICT supplier contract register is reportable and has to be current
• Interpretation questions go to konsultacja.dora@knf.gov.pl
• Smaller entities may use a simplified ICT risk management framework, which does not exempt them from incident reporting

Penalties

Breaches carry penalties of up to 2% of a financial entity's total annual turnover. For ICT providers designated as critical, fines can reach 5 million euro. In practice, though, a different consequence often bites harder: supervisory decisions restricting activity or requiring termination of a supplier contract.

Where to start

If implementation is behind, order matters. These steps return the most for the least effort:

• Inventory your ICT suppliers and complete the contract register, because inspections usually start there
• Decide who classifies an incident as major, on what basis, and who files within 4 hours
• Check that key supplier contracts carry audit rights, service levels and exit terms
• Put round-the-clock detection in place, for example SOC-as-a-Service, because the deadlines are unrealistic without it
• Plan the testing programme, including penetration testing, and TLPT for significant entities
• Monitor for leaked credentials, since exposure in stealer logs is ICT risk in the sense of Article 8
• If the capability gap is at board level, consider a virtual CISO rather than a vacancy that runs for a year

DORA and NIS2

Both deal with digital resilience and are often confused. The distinction is simple: DORA is sector-specific law for finance and takes precedence over NIS2 where the two overlap. A financial entity therefore applies DORA rather than NIS2, though groups with activity outside the financial sector can end up under both regimes at once.

Conclusion

DORA introduces no technical requirement any security team would find unfamiliar. What is new is that it assigns those requirements to named people, sets deadlines measured in hours, and attaches penalties. The biggest gaps we see are not technical. They are about who makes the classification call at 2am on a Saturday.

The four-hour clock starts when you classify the incident. The catch is that somebody has to notice it first.