DORA - Digital Operational Resilience Act (EU 2022/2554)
The Digital Operational Resilience Act (DORA) is EU Regulation 2022/2554, applied from 17 January 2025. DORA establishes a uniform framework for ICT risk management, incident reporting, operational resilience testing, and oversight of critical third-party ICT providers across the EU financial sector. Unlike a directive, DORA is a regulation: it applies directly without national transposition.
DORA Incident Reporting Timeline
Article 19 of DORA establishes incident reporting obligations for "major" ICT-related incidents:
- Initial notification: as soon as possible, within 4 hours after classification as major and at most 24 hours after becoming aware
- Intermediate report: within 72 hours of initial notification, providing additional detail on impact and root cause
- Final report: within 1 month of the initial notification, with full incident details, impact assessment, and remediation
Reports are filed with the financial entity's competent authority. Significant cyber threats may also be reported voluntarily.
Who Is in Scope
DORA applies to financial entities including credit institutions, payment institutions, e-money institutions, investment firms, crypto-asset service providers, insurance and reinsurance undertakings, pension funds, fund managers, central counterparties, trade repositories, and central securities depositories. It also applies to critical ICT third-party service providers designated by the European Supervisory Authorities under direct EU oversight.
Five Pillars of DORA
- ICT risk management: governance, identification, protection, detection, response, recovery
- ICT incident reporting: classification, notification, and final reporting
- Digital operational resilience testing: vulnerability assessments, scenario-based testing, threat-led penetration testing
- ICT third-party risk management: contractual requirements, register of contracts, exit strategies
- Information and intelligence sharing: voluntary sharing of cyber threat information among financial entities
Meet DORA incident reporting deadlines
IR-OS supports the DORA 4-hour, 24-hour, 72-hour, and one-month deadlines with role-based workflows and audit-ready records for ESAs and national competent authorities.
Start free