DORA compliance: what you need to know

The DORA regulation (Digital Operational Resilience Act) is a comprehensive EU framework designed to strengthen ICT risk management across the financial sector. As a DORA law, it sets clear expectations for how organisations identify, manage and respond to digital disruptions.

According to Dirk Jan, DORA is about control and preparedness. “DORA does not assume that incidents will never happen,” he explains. “It requires organisations to demonstrate that they can absorb shocks and recover quickly.”

DORA compliance applies to a wide range of financial institutions, including banks, insurers, asset managers, payment service providers and fintechs, collectively referred to as DORA for financial entities.

UK-based organisations may fall under DORA if they:

• operate in the EU;
• provide services to EU-regulated financial entities;
• are part of a cross-border financial group.

“DORA has a clear extraterritorial effect,” notes Dirk Jan. “UK organisations cannot ignore it if they are part of the European financial ecosystem.”

The DORA requirements are structured around a set of clearly defined DORA obligations covering five key areas:

• ICT risk management;
• Incident detection and reporting;
• Digital operational resilience testing;
• Management of third-party ICT risks;
• Information sharing on cyber threats.

“What makes DORA unique is its integrated approach,” says Dirk Jan. “It connects governance, technology and third-party oversight into one regulatory framework.”

At the core of DORA lies digital operational resilience, the ability to prevent, withstand, respond to and recover from ICT-related disruptions. This requires mature ICT risk management practices across the organisation.

“Digital operational resilience is not a one-off project,” Dirk Jan emphasises. “It is a continuous capability that must be tested, reviewed and improved.” This includes regular risk assessments, resilience testing and clearly defined responsibilities at senior management level.

Preparing for DORA compliance starts with understanding your current maturity level in ICT risk management. Organisations should assess existing policies, controls and third-party arrangements against DORA requirements.

Dirk Jan advises a structured approach. “Start with visibility: know your critical systems, your key suppliers and your biggest risks. Only then can you close the gaps effectively.” Preparation should be phased, evidence-based and well documented.

DORA places significant emphasis on third-party risk. DORA for IT providers means stricter oversight, clearer contractual obligations and greater transparency.

Under the DORA regulation, financial entities remain accountable, but IT providers are expected to actively support resilience, incident handling and audits. “Third-party providers are no longer just vendors,” says Dirk Jan. “They become part of the regulatory risk landscape.”

ISPnext helps UK organisations achieve and maintain DORA compliance by structuring ICT risk management, supplier oversight and reporting processes.

“Our focus is on making digital operational resilience measurable and manageable,” explains Dirk Jan. By centralising data, risks and controls, ISPnext enables organisations to demonstrate digital operational resilience in a way that aligns regulatory requirements with day-to-day operations.