# What is DORA, in plain terms?

The Digital Operational Resilience Act (DORA), Regulation (EU) 2022/2554, is the EU law on the digital resilience of the financial sector. It requires banks, insurers, investment firms, payment institutions and other financial entities to withstand and recover from technology failures and cyber attacks. It applies directly in every Member State and rests on a few pillars: an ICT risk-management framework owned by the management body; classification and reporting of major ICT-related incidents to the competent authority; regular testing of digital operational resilience, with advanced threat-led penetration testing for some entities; managing the risk of ICT third-party providers, including contract requirements and an exit strategy; and voluntary sharing of threat information. For providers that the European supervisory authorities designate as critical, DORA adds direct oversight. For a financial entity, DORA is the specific rulebook, taking precedence over the general NIS2 rules where they overlap. If you supply ICT services to financial entities, expect DORA to arrive through contracts and questionnaires. NetSenX is not a DORA tool as such; its detection can support the monitoring part of an ICT risk framework.

General information, not legal advice. National laws can add to the EU texts quoted here, for example deadlines, forms or reporting channels: check your own country's rules.

FAQ: [EU law: GDPR, DORA, CRA and AI Act](https://netsenx.com/en/faq/eu-law) · https://netsenx.com/en/faq/what-is-dora-in-plain-terms

## Read next

- https://netsenx.com/en/blog/2026-10-26_ai-act-nis2-dora-cra
- https://netsenx.com/en/compliance
- https://netsenx.com/en/dpa

## Related questions

- [What does DORA require from the management of a financial entity?](https://netsenx.com/en/faq/what-does-dora-require-from-management)
- [What is the Cyber Resilience Act, in plain terms?](https://netsenx.com/en/faq/what-is-the-cyber-resilience-act)
- [Does the Cyber Resilience Act apply to software companies?](https://netsenx.com/en/faq/does-the-cra-apply-to-software-companies)
- [Does the Cyber Resilience Act apply to software as a service?](https://netsenx.com/en/faq/does-the-cra-apply-to-saas)
- [What is an SBOM, and does the Cyber Resilience Act require one?](https://netsenx.com/en/faq/what-is-an-sbom-and-does-the-cra-require-one)