What is DORA, in plain terms?

The Digital Operational Resilience Act (DORA), Regulation (EU) 2022/2554, is the EU law on the digital resilience of the financial sector. It requires banks, insurers, investment firms, payment institutions and other financial entities to withstand and recover from technology failures and cyber attacks. It applies directly in every Member State and rests on a few pillars: an ICT risk-management framework owned by the management body; classification and reporting of major ICT-related incidents to the competent authority; regular testing of digital operational resilience, with advanced threat-led penetration testing for some entities; managing the risk of ICT third-party providers, including contract requirements and an exit strategy; and voluntary sharing of threat information. For providers that the European supervisory authorities designate as critical, DORA adds direct oversight. For a financial entity, DORA is the specific rulebook, taking precedence over the general NIS2NIS2: the EU's second Network and Information Security directive. The EU cybersecurity law (Directive (EU) 2022/2555) that sets security and incident-reporting duties for many companies. rules where they overlap. If you supply ICT services to financial entities, expect DORA to arrive through contracts and questionnaires. NetSenX is not a DORA tool as such; its detection can support the monitoring part of an ICT risk framework.

General information, not legal advice. National laws can add to the EU texts quoted here, for example deadlines, forms or reporting channels: check your own country's rules.

← All 20 questions on EU law: GDPR, DORA, CRA and AI ActAll topics