# DORA: EU Digital Operational Resilience Act

> EU regulation on ICT risk and operational resilience for financial entities and their critical ICT providers, applying since January 2025.

URL: https://securei3.com/standards/dora/
Category: Global & regional laws: Law or regulation
Provider: Secure iQube (independent consultancy; ISO certificates are issued by accredited certification bodies; SOC and ISAE reports by licensed CPA and audit firms, which Secure iQube can arrange through partner firms)


The Digital Operational Resilience Act has applied since 17 January 2025. It requires an ICT risk management framework, classification and reporting of major ICT incidents, digital operational resilience testing, and management of ICT third-party risk. We help financial entities close gaps and help their suppliers meet contractual DORA requirements.

## Who it is for

- Banks, insurers, investment firms and payment institutions in the EU
- ICT service providers to EU financial entities
- Non-EU vendors with EU financial clients

## Benefits

- Meets supervisory expectations
- Contract terms ready for financial clients’ DORA clauses
- Builds on ISO 27001 and ISO 22301

## How Secure iQube helps

1. **Applicability and scoping**: Confirm whether and how the law applies to you, entities, data, systems, roles and territories.
2. **Data and process mapping**: Build a record of processing or control inventory so obligations can be tied to real systems and owners.
3. **Gap assessment**: Measure current practice against each obligation and rank the gaps by legal and business risk.
4. **Remediation roadmap**: Policies, notices, contracts, technical controls and governance, sequenced so the highest risks close first.
5. **Evidence and ongoing monitoring**: A compliance calendar, metrics and periodic reviews so you can demonstrate compliance to a regulator or customer at any time.

## Frequently asked questions

### Does DORA apply to vendors outside the EU?

DORA applies directly to EU financial entities, but they must flow requirements into contracts with ICT providers anywhere in the world. Critical ICT third-party providers can also be designated for direct oversight.

Related: https://securei3.com/standards/iso-22301/, https://securei3.com/standards/iso-27001/, https://securei3.com/standards/nis2/

Contact: https://securei3.com/contact/: info@securei3.com