RegulationEuropean Union

Digital Operational Resilience Act (DORA)

Strengthens the digital operational resilience of the EU financial sector.

Classification

Regulation

Issuing authority

European Union (Regulation (EU) 2022/2554)

Jurisdiction

European Union · Sector: Financial services

Status / edition

In force / applies

Key dates

Entered into force January 2023; applies from 17 January 2025

Mandatory or voluntary

Mandatory (sector-specific)

Who it applies to

A broad range of EU financial entities and their critical ICT third-party providers.

Purpose

Strengthens the digital operational resilience of the EU financial sector.

Major requirements / obligations

  • ICT risk management
  • ICT incident reporting
  • Digital operational resilience testing
  • ICT third-party risk management
  • Information sharing

Control domains

GovernanceRisk assessmentIncident responseBusiness continuitySupplier management

Last reviewed

2026-10-18 (source verification date)

This library provides general information for orientation only. It is not legal advice, a determination of applicability, or a substitute for formal certification or professional counsel. Verify current legal status, editions and dates against the official source before relying on any entry. Inclusion of a jurisdiction or instrument here is informational and does not imply that Srida IT provides regulated services, holds local authorisation, or has a presence in that jurisdiction.