DORA

Regulation (EU) 2022/2554 covers some twenty categories of financial entity listed in Art. 2, from credit institutions, investment firms and insurers to payment and e-money institutions, crypto-asset service providers, trading venues and central counterparties, and is accompanied by an amending directive (EU) 2022/2556 that aligns sectoral directives. Most of the operational detail sits in level-2 acts: Commission Delegated Regulation (EU) 2024/1774 on the ICT risk-management framework (including logging and log retention), 2024/1772 on incident classification criteria, 2025/301 on the content and timing of incident reports, and implementing standards for the register of information. Proportionality is built in via Art. 4, and Art. 16 gives small and non-interconnected entities a simplified risk-management framework; microenterprises are relieved of several requirements.

The regulation has five pillars. ICT risk management (Arts. 5-16) makes the management body ultimately responsible (Art. 5(2)) and requires an ICT risk-management framework covering identification of assets and dependencies, protection, detection, response and recovery, backup and restoration, and learning. Incident management (Arts. 17-23) requires classification of ICT-related incidents against quantitative and qualitative criteria (clients affected, duration, geographic spread, data losses, criticality of services, economic impact); for a major incident, the initial notification is due within four hours of classifying it as major and no later than 24 hours after becoming aware, the intermediate report within 72 hours of the initial notification, and the final report within one month of the latest intermediate report. Digital operational resilience testing (Arts. 24-27) requires a risk-based testing programme with at least yearly testing of critical systems, and threat-led penetration testing (TLPT) on live production systems at least every three years for entities selected by the competent authority, modelled on the TIBER-EU framework.

ICT third-party risk (Arts. 28-30) requires a register of information on all contractual arrangements with ICT providers, pre-contract due diligence, exit strategies, and the mandatory contract clauses in Art. 30, which are stricter for services supporting critical or important functions. The oversight framework (Arts. 31-44) lets the European Supervisory Authorities designate critical ICT third-party providers and oversee them through a Lead Overseer; the first list of 19 providers, including major hyperscalers, was published on 18 November 2025 and is to be updated yearly. The fifth pillar, Art. 45, allows voluntary cyber threat information sharing.

DORA is lex specialis to NIS2 for financial entities, and NIS2 Art. 4 defers to it, so a Danish bank reports major ICT incidents to Finanstilsynet under DORA rather than following NIS2 Art. 23 timelines. A common misreading is that DORA applies to cloud providers directly: it binds the financial entity, and only designated CTPPs are reached through ESA oversight; other suppliers are affected indirectly through the contract terms their customers must impose.