The DORA Act is a comprehensive regulatory framework designed to enhance the digital operational resilience of financial entities across the European Union. Its applicability extends to a wide array of financial institutions, including

• Banks
• Insurers & Reinsurers
• Brokers
• Payment service providers
• Electronic money institutions
• Investment firms
• Crypto-asset providers

The reach of the DORA Act is not limited to the entities themselves but also extends to their ICT third-party service providers. This inclusion is crucial, as many financial institutions rely heavily on external partners for critical ICT services. By mandating that these third-party providers adhere to stringent risk management and resilience standards, the DORA Act ensures that the entire supply chain is robust and secure.

• ICT risk management: Key obligations include cybersecurity governance including asset inventory, implementing certain key documents and processes such as an Information Security Policy and a Business Continuity Plan
• Third-party ICT risk management: Vendors must undergo due diligence and extensive contracting obligations apply
• Reporting of major ICT-related incidents: Which incidents need to be reported and the content of reporting must meet specific criteria, detailed in related guidance;
• Testing of digital operational resilience: Including thread-let penetration testing for entities that are relevant for the stability of the EU financial sector
• Information and intelligence sharing: Voluntary sharing of cyber threat information and threat intelligence.