EU Digital Operational Resilience Act (DORA) implementation

The Digital Operational Resilience Act (DORA) is set to take effect in early 2025, establishing a harmonized framework for operational resilience across the European financial sector. Developed by the European Commission, EU Supervisory Authorities, and national regulators, the act aims to ensure that financial entities and their ICT service providers can withstand, respond to, and recover from information and communication technology-related disruptions.

DORA applies to approximately 20 different types of financial entities, including traditional and digital banks, insurance companies, investment firms, and asset managers. It also extends to critical third-party service providers, such as cloud services and data analytics firms. The regulation mandates several core requirements, including the implementation of robust risk management frameworks and streamlined incident reporting processes to ensure rapid detection and notification of ICT-related incidents.