DORA: what financial entities must have ready

The Digital Operational Resilience Act (DORA) has applied since 17 January 2025 to banks, insurers, asset managers, payment service providers and most financial players in the European Union, with no national transposition needed. Almost two years on, supervisors no longer ask whether entities know the text: they check what they can produce.

ICT risk management owned by management

DORA requires a documented framework for managing information and communication technology (ICT) risk, reviewed at least once a year, for which the management body bears ultimate responsibility: it defines it, approves it and oversees its implementation. Like NIS2, DORA makes digital resilience a governance matter.

The register of information on providers

Each entity keeps a register of all its contractual arrangements with ICT service providers, identifying those that support critical or important functions. In France, the register is submitted to the authorities using the templates of Implementing Regulation (EU) 2024/2956, through the Banque de France ONEGATE portal. It is often the heaviest workstream: it requires knowing exactly who does what, where, and with which subcontractors.

Reporting a major incident: 4 hours, 72 hours, one month

An ICT-related incident classified as major is reported to the competent authority (the ACPR or AMF in France) in three steps:

• an initial notification within 4 hours of classifying it as major, and no later than 24 hours after becoming aware of it;
• an intermediate report no later than 72 hours after the initial notification;
• a final report no later than one month after the last intermediate report.

The classification criteria are set by Delegated Regulation (EU) 2024/1772. Meeting these deadlines requires a classification procedure that is ready and rehearsed, and coordination with other obligations, such as notifying a personal data breach to the data protection authority.

Testing resilience, up to threat-led penetration testing

DORA requires a proportionate resilience testing programme. The most significant entities, designated by their supervisor, also carry out threat-led penetration testing (TLPT) at least every three years, on live production systems and following a realistic scenario.

What to remember

DORA is not satisfied by written policies: it takes an accurate register, reporting procedures that meet the deadlines and tests that prove resilience. Designing the architecture that makes these requirements achievable, then implementing and documenting the measures through to proof, is the role of Trusted Architecture and Trusted Integration, after a Trusted Assessment.