Strengthening Digital Operational Resilience in the Financial Sector
The Digital Operational Resilience Act (DORA) is a landmark European Union regulation designed to ensure that financial entities can withstand, respond to, and recover from all types of ICT-related disruptions and cyber threats.
Unlike previous regulatory frameworks that focused primarily on financial risk, DORA explicitly addresses operational resilience in the digital domain. It establishes a unified framework for ICT risk management, incident reporting, resilience testing, and third-party risk oversight across the EU financial sector.
As financial services become increasingly dependent on digital infrastructure, cloud platforms, and interconnected third-party providers, DORA ensures that operational resilience is treated as a core regulatory requirement rather than a secondary IT concern.
What Is DORA?
DORA (Regulation (EU) 2022/2554) entered into force in January 2023 and became fully applicable in January 2025, with supervisory enforcement activities continuing into 2026 and beyond.
It applies to a wide range of financial entities, including:
- Banks and credit institutions
- Insurance companies
- Investment firms
- Payment institutions
- Electronic money institutions
- Crypto-asset service providers
- Financial market infrastructures
- ICT third-party service providers supporting financial entities
The regulation ensures that all participants in the financial ecosystem maintain a consistent level of digital operational resilience.
Why DORA Was Introduced
The financial sector has undergone rapid digital transformation over the past decade, leading to increased reliance on:
- Cloud computing platforms
- Fintech ecosystems
- Outsourced ICT services
- Real-time digital payment systems
- Complex global supply chains
At the same time, cyber threats targeting financial institutions have become more frequent, sophisticated, and financially impactful.
Key risks include:
- Ransomware attacks disrupting banking operations
- Third-party outages affecting critical financial services
- Data breaches exposing sensitive financial information
- Systemic risk from concentrated ICT service providers
DORA was introduced to address these systemic vulnerabilities by ensuring consistent resilience standards across the EU financial sector.
Key Pillars of DORA
DORA is structured around five core pillars that define how financial organizations must manage ICT risk and operational resilience.
1. ICT Risk Management
Financial entities must implement a comprehensive ICT risk management framework that covers all systems, networks, and information assets.
This includes:
- Identification and classification of ICT assets
- Risk assessment methodologies
- Security policies and controls
- Monitoring and detection capabilities
- Continuous improvement processes
ICT risk management must be fully integrated into the organization’s overall governance framework.
2. ICT-Related Incident Management and Reporting
Organizations must establish structured processes to:
- Detect ICT-related incidents
- Classify severity and impact
- Respond and mitigate disruptions
- Report incidents to competent authorities within strict timelines
DORA introduces harmonized reporting requirements across the EU, reducing fragmentation but increasing the need for mature incident response capabilities.
Timely and accurate reporting is a key compliance requirement and a critical supervisory focus area.
3. Digital Operational Resilience Testing
DORA requires financial entities to regularly test their ICT systems to ensure resilience against cyber threats and operational disruptions.
Testing activities may include:
- Vulnerability assessments
- Penetration testing
- Scenario-based testing
- Threat-led penetration testing (TLPT) for critical entities
- Recovery and failover testing
Testing must be risk-based and proportionate, with results feeding into continuous improvement processes.
4. ICT Third-Party Risk Management
One of the most significant components of DORA is its focus on third-party ICT risk.
Financial entities must:
- Maintain a register of ICT service providers
- Assess risks associated with outsourcing arrangements
- Ensure contractual security requirements are in place
- Monitor third-party performance and resilience
- Manage concentration risk
ICT third-party providers supporting critical functions are also subject to direct oversight by European supervisory authorities.
5. Information Sharing Arrangements
DORA encourages financial entities to participate in cyber threat intelligence sharing arrangements.
This enables organizations to:
- Improve situational awareness
- Detect emerging threats earlier
- Coordinate responses to cyber incidents
- Strengthen sector-wide resilience
Information sharing must be conducted in a secure and structured manner.
ICT Risk in the Financial Sector
Financial institutions operate in one of the most targeted industries globally.
Common threats include:
- Advanced persistent threats (APTs)
- Ransomware-as-a-service (RaaS) groups
- Insider threats
- Supply chain compromises
- Cloud misconfigurations
- API exploitation in fintech ecosystems
Even short-term outages can result in significant financial loss, regulatory scrutiny, and reputational damage.
DORA aims to ensure that organizations are prepared not only to prevent these events but also to maintain continuity when they occur.
Governance and Accountability
DORA places significant emphasis on governance and senior management responsibility.
Financial entities must ensure that:
- ICT risk management frameworks are approved and overseen by management bodies
- Senior leadership understands ICT risks and operational resilience strategies
- Adequate resources are allocated to resilience initiatives
- ICT risk is integrated into enterprise risk management
Boards and executive leadership are expected to actively engage in ICT risk oversight rather than delegating responsibility entirely to technical teams.
Relationship Between DORA and Other EU Regulations
DORA operates alongside other EU regulatory frameworks, including:
- NIS2 Directive (broader cross-sector cybersecurity requirements)
- GDPR (data protection and privacy obligations)
- EU AI Act (AI governance and risk management)
While NIS2 applies broadly across critical sectors, DORA is specifically tailored to the financial sector and provides more detailed operational resilience requirements.
Organizations operating in financial services must therefore consider overlapping obligations across multiple regulatory regimes.
Common DORA Compliance Challenges
Many financial organizations face similar challenges when preparing for DORA compliance:
- Limited visibility into ICT third-party risk exposure
- Fragmented incident response processes
- Lack of harmonized reporting structures
- Insufficient resilience testing maturity
- Weak integration between ICT and enterprise risk management
- Incomplete documentation and audit readiness
A common misconception is that existing IT security frameworks or ISO 27001 certification are sufficient to meet DORA requirements.
While these frameworks provide a strong foundation, DORA introduces additional regulatory obligations that require dedicated operational resilience capabilities.
ISO 27001 and Operational Resilience
ISO/IEC 27001 provides a structured Information Security Management System (ISMS) that supports:
- Risk-based security management
- Control implementation
- Auditability and governance
- Continuous improvement
These elements align closely with DORA’s ICT risk management expectations.
However, organizations must extend beyond ISO 27001 to address:
- Regulatory incident reporting requirements
- ICT third-party oversight obligations
- Formal resilience testing programs
- Supervisory reporting expectations
A dedicated DORA gap assessment is often required to ensure full alignment.
How Intertek Can Help
Intertek supports financial organizations and ICT service providers in achieving DORA readiness through structured, risk-based advisory and assessment services.
DORA Gap Assessments
Evaluate current ICT risk and operational resilience maturity against DORA requirements and identify compliance gaps.
ICT Risk Management Framework Development
Support design and enhancement of ICT risk frameworks aligned with regulatory expectations and industry best practices.
Incident Response and Reporting Readiness
Assess and improve incident detection, response, escalation, and reporting capabilities.
Third-Party Risk Management
Strengthen ICT supplier oversight, contractual controls, and concentration risk management.
Operational Resilience Testing Support
Evaluate testing strategies, resilience validation approaches, and recovery capabilities.
ISO 27001 Integration
Align existing ISMS frameworks with DORA requirements to reduce duplication and improve efficiency.
Building Long-Term Operational Resilience
DORA represents a fundamental shift in how financial organizations are expected to manage ICT risk. It moves beyond compliance checklists toward continuous operational resilience and governance accountability.
Organizations that invest early in structured ICT risk management, robust third-party oversight, and resilience testing will be better positioned not only for compliance but also for long-term stability in an increasingly complex digital financial ecosystem.
Talk to Intertek
Intertek helps financial institutions and ICT service providers navigate DORA requirements through practical assessments, advisory services, and implementation support.
Contact our cybersecurity and resilience specialists to assess your current readiness and strengthen your operational resilience strategy.
