Overview
The Digital Operational Resilience Act (DORA) is an EU regulation that harmonizes ICT risk management requirements across the financial sector, applicable from January 2025.
Purpose
Ensure that banks, insurers, investment firms, and their critical ICT providers can withstand, respond to, and recover from ICT-related disruptions.
Architecture
DORA is built on five pillars: ICT risk management, ICT incident reporting, digital operational resilience testing, ICT third-party risk management, and information sharing.
Core Concepts
- Critical ICT third-party providers — subject to an EU oversight framework.
- Threat-led penetration testing (TLPT) — advanced resilience testing for significant entities.
Cloud Mapping
Third-party-risk and resilience-testing obligations shape how financial entities contract for and monitor AWS, Azure, and GCP services, including exit strategies and concentration risk.
References
See the primary source below.