Regulation · DORA

DORA: what it is and how to comply

The DORA regulation requires digital operational resilience across the EU financial sector and has applied since 17 January 2025. What it covers, who it applies to and how to comply: we take you from gap analysis to compliance, managing ICT risk and third-party providers.

Request an assessment

Applicable since January 2025 · dedicated advisor

In short

What the DORA regulation is

DORA (Digital Operational Resilience Act) is the EU regulation that requires banks, insurers and other financial entities to ensure digital operational resilience. It covers ICT risk management, incident reporting, resilience testing and the management of third-party ICT service providers.

Structured ICT risk management
Reporting of major ICT-related incidents to the authorities
Digital operational resilience testing
Oversight of critical ICT providers

Who it applies to

Who DORA is for

Financial entities

Banks, insurers, investment firms, payment institutions, asset managers and the other financial entities listed in Article 2 of the regulation.

ICT providers to the financial sector

Companies providing technology services to financial entities are drawn in as third-party providers through contractual requirements, and the critical ones fall under direct EU oversight.

Providers of critical services

Cloud, software and infrastructure that financial processes depend on: resilience becomes a contractual requirement.

How we help

From gap analysis to resilience

We build the ICT risk management framework, prepare the tests and keep third parties under control, with a SOC watching 24/7.

DORA Gap Analysis

We assess where you stand against the pillars of the regulation and define a prioritised remediation plan.

ICT risk and testing

We implement the ICT risk management framework and the incident reporting procedures, and prepare the resilience tests.

WIZ · VANTA

Third-party management and SOC

We monitor critical ICT providers and run 24/7 detection and response, supporting your continuity obligations.

How it works

The path to compliance

Gap Analysis

We map processes, ICT risk and providers against the DORA requirements. A report with the remediation priorities.

Implementation

We build the risk framework, the incident reporting procedures and the register of information on ICT providers, automating the evidence.

Operations and testing

Periodic resilience testing, monitoring of critical providers and a 24/7 SOC for detection, response and reporting.

FAQ

Questions about DORA

When did DORA start to apply?

The regulation has applied since 17 January 2025. Entities in scope are already required to meet its requirements, so closing the gaps early matters.

What is the difference between DORA and NIS2?

NIS2 is a directive that cuts across many sectors; DORA is a regulation specific to the financial sector and, for financial entities, takes precedence as the reference framework on ICT resilience.

Does DORA also affect my providers?

Yes. One of the pillars is managing the risk from third-party ICT service providers, with contractual and monitoring obligations that extend to the critical providers.

Where should we start?

With a gap analysis on the pillars of the regulation: ICT risk, incidents, testing and third parties. Then we define a realistic remediation plan for your context.

In scope for DORA and want to comply?

A 30-minute call to understand where you stand today and the next steps towards operational resilience. No commitment.

Book a call