DORA

Yes. The DORA framework applies to nearly all financial entities, including small investment firms, insurance brokers, payment institutions, and credit institutions.

However, microenterprises (typically under 50 employees and 10 million euro annual revenue) may benefit from simplified risk management rules proportionate to their size. Despite simplified requirements, they must still comply with core DORA obligations including incident reporting, basic ICT risk management, and third-party risk oversight. There are no blanket exemptions - compliance is mandatory across the financial sector.

DORA and NIS2 are complementary but distinct frameworks.

DORA is a lex specialis for the financial sector, so its specific rules take precedence over the more general NIS2 framework for financial entities. Prioritize DORA compliance while using NIS2 as a supplementary baseline for non-financial operations.

DORA focuses on five core pillars that form the foundation of digital operational resilience.

All five pillars must be implemented comprehensively, with integrated policies covering governance, technical controls, incident response, testing schedules, and vendor management.

Yes. DORA mandates penetration testing to validate network security and demonstrate operational resilience. Required activities include:

• Annual penetration testing of ICT systems touching critical or important functions.
• External-perspective testing (simulating an attacker's viewpoint).
• Internal network testing (validating segmentation effectiveness).
• Application-level testing for critical financial applications.
• Threat-led penetration testing (TLPT) for critical entities.

Testing must be conducted by qualified personnel with financial-sector expertise, results documented, vulnerabilities remediated within defined SLAs, and findings reported to the Board.

DORA sets strict incident reporting timelines, similar to NIS2.

Be ready for the 24-hour early-warning window with detection capabilities, classification procedures, and reporting templates. Classification follows DORA criteria (major vs non-major) based on impact duration, data loss, financial impact, and service disruption.

Yes. DORA requires comprehensive third-party risk management (TPRM), including:

• Risk evaluations for all ICT service providers (software vendors, cloud providers, data centers).
• Contractual requirements defining security obligations, incident reporting, audit rights, and exit clauses.
• Supply-chain risk assessments identifying threats posed by third-party providers.
• Critical TPP oversight for providers designated 'critical' (such as major cloud providers).
• Exit strategies ensuring you can migrate services if a vendor fails.
• Continuous monitoring of provider security posture, compliance status, and incident history.

DORA specifically addresses concentration risk (many firms using the same provider) and subcontracting risk. Maintain an inventory of all ICT providers with risk ratings and monitoring schedules.

Absolutely. DORA mandates human-resources security requirements, including:

• Continuous cybersecurity awareness training for all employees (annual minimum).
• Role-based training for ICT staff, security teams, and incident responders.
• Phishing simulation exercises to test employee vigilance.
• Incident response training for relevant personnel.
• Background checks for personnel accessing critical ICT systems.
• Security policy acknowledgments confirming understanding.

Training must be documented, with attendance, completion rates, and assessment results reported to the Board. Critical roles should receive more frequent updates.

DORA requires Board-level accountability for digital operational resilience. Executive reports must include:

Board reports should be quarterly (minimum), concise, risk-focused, and actionable.

Yes. A gap analysis and readiness assessment is the recommended first step to find where current systems fall short of DORA's mandatory requirements. Deliverables include:

• A current-state assessment across all five DORA pillars.
• A mandatory-control inventory mapping existing controls to DORA requirements.
• Gap identification highlighting missing controls, policies, or technical capabilities.
• Risk prioritization categorizing gaps by severity.
• A remediation roadmap with timeline, resources, and milestones.
• Resource estimation for tools, training, consultancy, and implementation.

DORA defines operational resilience as the ability to prevent, detect, respond to, and recover from ICT disruptions while maintaining critical functions. Demonstration requires:

Demonstrate measurable resilience through testing results, incident metrics (MTTD, MTTR), uptime statistics, and Board oversight documentation. Regulators expect continuous improvement, not one-time compliance.