DORA compliance: digital operational resilience for the financial sector

DORA has been mandatory since January 2025 for banks, insurers, fund managers and a long list of financial entities in the EU. We assess your current situation, identify the gaps and support you through the compliance process.

Scope your project · Assess my DORA compliance

Rather talk it through? Call us at +34 960 730 013

DORA is not optional for the financial sector

The DORA Regulation (Digital Operational Resilience Act) became applicable in January 2025. It affects thousands of financial entities in the EU: banks, insurers, investment firms, fund managers, payment service providers and their critical technology providers. Non-compliance can lead to significant penalties and, above all, can expose the entity's inability to manage a digital crisis.

What DORA covers and how we help

  • Governance and management body accountability for ICT risk
  • ICT risk management framework: identification, protection, detection and recovery
  • Management and notification of major ICT incidents
  • Digital operational resilience testing (TLPT - Threat-Led Penetration Testing)
  • Third-party ICT risk management (technology supply chain)
  • Contractual arrangements with ICT providers: mandatory DORA clauses

DORA compliance process

  1. Initial assessment: We analyze the type of entity, the scope of application and the current state of DORA's five pillars.
  2. Gap analysis: We compare the current situation with the Regulation's requirements, including the RTS and the EIOPA/EBA/ESMA guidelines.
  3. Compliance plan: We design an action plan with priorities, deadlines and owners for each identified gap.
  4. Technical implementation: We support the implementation of resilience testing, the ICT risk management framework and incident response protocols.
  5. Regulatory documentation: We draft the documentation required by DORA: registers, policies, procedures and provider contracts.

Deliverables

  • Applicability analysis and entity classification report
  • Gap analysis against DORA's five pillars (risk management, incidents, testing, third parties, information sharing)
  • Compliance plan with timeline and resource estimate
  • Documented ICT risk management framework
  • Support with the design and execution of TLPT if required

Which entities does DORA affect?

  • Credit institutions (banks)
  • Investment firms and fund managers
  • Payment and electronic money institutions
  • Insurers and reinsurers
  • Crypto-asset service providers
  • Critical ICT providers of financial entities

Frequently asked questions about DORA

How does DORA differ from NIS2?

NIS2 is a horizontal directive affecting multiple sectors. DORA is a sector-specific regulation for the financial sector, with more detailed and technical requirements, especially regarding resilience testing (TLPT) and ICT provider management.

What is TLPT testing and who must perform it?

TLPT (Threat-Led Penetration Testing) is advanced penetration testing based on real threat intelligence, targeting the entity's most critical systems. It's only mandatory for significant entities designated by the competent authorities. We can run it with the TIBER-EU methodology.

Does DORA also affect technology providers of financial entities?

Yes. DORA establishes a direct oversight regime for critical ICT providers. And even if you're not a critical ICT provider, if you're a technology provider to a financial entity, they will require you to include DORA contractual clauses in the service agreement.

When does DORA become enforceable?

It has applied since January 2025, so there is no grace period ahead: the obligations are already enforceable for entities in scope. What is still under way is the rollout of supervision and the designation of entities for advanced testing, which comes through a communication from the competent authority. Not having received that communication does not exempt you from the rest of the regulation.

What about our ICT providers?

Through your contracts. DORA requires maintaining a register of information on ICT providers, including minimum clauses in contracts — audit rights, service levels, incident notification, cooperation with the supervisor — and holding a documented exit strategy for those supporting critical functions. Those designated as critical providers also come under direct European oversight, but that is the authorities' decision, not yours.

Does TLPT apply to us, or is the general testing program enough?

Every entity in scope must have the general testing program. TLPT — threat-led red teaming, at least every three years — is only required of entities the competent authority designates based on size, risk profile and systemic relevance. In Spain the authority is the Banco de España, the CNMV or the DGSFP depending on entity type, and the reference framework is TIBER-ES.

Related resources

Sources

Ready to protect your business?

Answer the scoping form at your own pace and we'll use it to prepare your proposal. If you'd rather talk first, book a free 30-minute call.

Scope your project · Assess my DORA compliance