The Digital Operational Resilience Act is designed to keep financial entities operational even during serious IT disruptions and cyber attacks. It harmonises requirements previously scattered across national circulars and guidelines and applies directly in all EU member states.
The five pillars
DORA is organised in five areas: ICT risk management with clear management accountability, classification and reporting of major ICT incidents, digital operational resilience testing up to threat-led penetration testing for significant institutions, management of ICT third-party risk, and voluntary information sharing on threats.
Register of information and contracts
Financial entities must keep a register of all contractual arrangements for ICT services and report it to supervisors. Contracts with ICT providers must contain certain minimum content, such as a description of the service, locations of data processing, audit rights, cooperation in incidents and exit rules. For providers this means new clauses, questionnaires and evidence, even though DORA does not oblige them directly.
Relationship with NIS2
For financial entities DORA takes precedence over NIS2 as the more specific law. ICT providers outside the financial sector may still fall under NIS2 themselves, for example as cloud or managed service providers. Particularly significant providers can also be designated as critical ICT third-party providers and placed under direct oversight by the European supervisory authorities.
What Swiss providers should know
DORA does not apply to financial institutions in Switzerland; there FINMA sets its own requirements in Circular 2023/1 on operational risks and resilience. Swiss software and cloud providers with customers in the EU financial sector, however, receive DORA requirements through those customers’ contracts. A compliance assessment clarifies which demands rest on DORA and which go beyond it.