Endorsed in the Official Journal of the European Union on December 27, 2022, DORA comprises a regulation and three directives.

Financial entities and ICT Suppliers supporting financial organisations have until mid-January 2025 to achieve compliance.

DORA readiness at a glance

What entities are subject to DORA?

DORA’s jurisdiction is EU-wide. It covers not only financial services entities operating in Europe but also providers of ICT services to the European Financial Sector, regardless of where services are provided from. A full list of financial entities subject to DORA can be found here.  

It isn’t yet clear whether the UK will mirror the EU’s approach to Digital Operational resilience. Many financial organisations operating domestically will already be subject to the PRA’s supervisory statement SS1/21 (Impact tolerances for important business services).

Suggested DORA readiness roadmap

If you feel your preparation for DORA is not on track, there is still time to get ready if you act now.

What does DORA require?

Requirements and obligations arising from DORA include those relating to:

• ICT risk management
• Third-party risk management
• Digital operational resilience testing
• Incident reporting
• Information sharing

We expect that many organisations will need to incorporate elements of the following into their change and readiness programmes:

• Identifying and mapping critical business functions
• Defining impact tolerances
• Update and creation of new policies, standards and procedures
• Implementation of updated and newly defined policies and standards, for instance those relating to incident management
• Making changes to systems and supporting technologies, potentially including migrations to alternative suppliers and supporting technologies
• Developing or updating and ICT risk management frameworks
• Updating the information security management system (ISMS)
• Mapping important third parties and performing enhanced supplier risk management.
• Working with customer organisations and supplier organisations to integrate their DORA readiness efforts with your own, including changes to third party risk monitoring, reporting, and intervention techniques
• Updating contracts with suppliers and those who you are a supplier to, e.g., incorporating improved assurance mechanisms
• Performing Digital Operational resilience testing
• Ensuring that records of compliance are all in order (or that any remaining gaps are understood and accounted for)

Approval reference 23119399