Accelerate and simplify DORA compliance.

The Digital Operational Resilience Act (DORA) is a legally binding EU regulation. It requires financial entities such as banks, insurers, investment firms, and their critical ICT (information and communications technology) third-party providers to build robust digital operational resilience, covering ICT risk management, incident reporting, resilience testing, and third-party risk oversight. It became fully applicable across the EU on 17 January 2025.

DORA compliance is structured around five core domains:

• ICT risk management and governance: Board-level ownership of a documented digital resilience strategy, risk tolerance, asset inventory, and security policies.
• Incident reporting: Classification, response, and timely reporting of major ICT-related incidents to regulators.
• Digital operational resilience testing: Including Threat-Led Penetration Testing (TLPT) for the largest, most critical entities.
• ICT third-party risk management: Due diligence, contractual safeguards, and ongoing oversight of vendors, including a mandatory Register of Information.
• Information and intelligence sharing: Voluntary arrangements for sharing cyber threat intelligence across the sector.

Non-compliance can result in significant financial penalties. Figures vary by region, but fines of up to 2% of annual turnover for financial entities, and even higher thresholds for designated critical third-party providers have been cited. Beyond fines, non-compliant organisations face operational restrictions and increased regulatory scrutiny, and individual board members and senior managers can be held personally accountable for failures in ICT risk governance.

The Register of Information is a mandatory, structured record of every contractual arrangement a financial entity holds with third-party ICT service providers. It must be maintained continuously and submitted to the relevant National Competent Authority annually. It has proven to be one of the more challenging requirements in practice, as many firms initially lacked a centralised view of their vendor contracts across procurement teams and business units. This is a key area where CyberKainos can help.

Yes, and in two ways. First, any non-EU financial institution with EU operations or EU-facing services falls within scope. Second, DORA directly regulates critical ICT third-party providers serving EU financial entities, regardless of where those providers are headquartered. A number of major global cloud and technology providers have already been formally designated as critical under the regulation.

DORA includes a principle of proportionality, meaning requirements scale according to an entity’s size, risk profile, and operational complexity. This means small / micro enterprises and financial entities benefit from a simplified ICT risk management framework under Article 16, so the compliance burden is significantly lighter than they are for large banks or systemically important institutions, but small and micro businesses are not exempt entirely.