Digital Operational Resilience Act (DORA)

Why is DORA needed?

The financial sector is increasingly dependent on technology and on tech companies to deliver financial services. This makes financial entities vulnerable to cyber-attacks or incidents.

When not managed properly, ICT risks can lead to disruptions of financial services offered across borders. This in turn, can have an impact on other companies, sectors and even on the rest of the economy, which underlines the importance of the digital operational resilience of the financial sector.

This is where the Digital Operational Resilience Act, or DORA, comes into play.

Implementing act

• Implementing and delegated acts - DORA
• Commission’s adopted implementing and delegated acts

Implementing and delegated acts in the official journal

• RTS on ICT risk management framework
• RTS on ICT incidents classification
• RTS on ICT third-party policy
• DR on CTPPs designation criteria
• DR on DORA oversight fees

Policy products as prepared by the ESAs:

• Delivery of First batch of policy products
• Delivery of the second batch of policy products (also on subcontracting)

Guidelines:

• Guidelines on oversight cooperation

Opinions:

• EIOPA Opinion on the scope of DORA in light of the review of the Solvency II framework

Decisions:

• ESAs Decision the reporting by competent authorities to the ESAs of information necessary for the designation of critical ICT third-party service providers

Other resources:

• Preparation for DORA application 
• Q&As on DORA:
  • look for previously answered questions on DORA
  • ask a question in relation to the application of DORA
• Establishing the EU's systemic cyber incident coordination framework (EU-SCICF)
• ESAs' report on the landscape of ICT third-party providers in the EU
• Commission’s rejection letter of the ITS on register of information
• ESAs' response to the Commission's rejection of ITS on registers of information

Consultations

• Joint Consultation on the first batch of DORA policy products
  • Joint ESAs public hearing on the first batch of DORA policy products
  • Results - Public Consultation on the first batch of DORA policy mandates
• Public consultation on the second batch of policy products (Art. 11(11), 20a, 20b, 26(11), 30(5), 32(7) and 41 DORA)
  • Joint ESAs public hearing on the second batch of DORA policy products
  • Joint Feedback from ESAs' stakeholder groups on the second batch of DORA policy products
  • Results - Public Consultation on the second batch of DORA policy mandates
• Call for advice on criticality criteria and fees
• Joint ESAs public event on DORA – Technical discussion