DORA (Digital Operational Resilience Act) is an EU regulation effective from January 17, 2025. It aims to enhance digital operational resilience in the financial services sector by standardizing information security risk management processes. This regulation ensures that financial institutions can withstand, respond to, and recover from cyber threats and operational disruptions effectively.

DORA introduces several information security risk management requirements categorized into:

• ICT Risk Management: Governance and processes for identification, protection, prevention, detection, response, and recovery.
• Incident Management: Procedures for incident detection, classification, remediation, and reporting.
• Third-Party Management: Selection process, assessment, contractual requirements, and regulatory reporting.
• Resilience Testing: Requirements for testing, governance, frequency, and regulatory reporting.

• To strengthen operational resilience and security of the entity.
• To avoid administrative penalties up to 2% of the total annual worldwide turnover or up to 1% of the company´s average daily turnover worldwide.
• Supervision and sanctions by the competent authority.

1. Analysis and Recommendations: We review and analyze your current status and provide recommendations to ensure compliance.
2. Documentation and Implementation: We help prepare relevant documents and implement necessary processes.
3. Technology Solutions and Testing: We assist in selecting the right technology solutions and conduct technical tests like penetration testing and vulnerability assessments.
4. Full Implementation Support: We guide you through the entire process, which typically takes 6-9 months to complete.

• DORA Regulation
• DORA Regulation


• First batch of Regulatory Technical Standards (RTS) and Implementing Technical Standards (ITS) from 17.1.2024:
• RTS on classification of major incidents and significant cyber threats
• RTS specifying the policy for ICT services supporting critical or important functions
• ITS on the information register
• RTS on ICT risk management framework and simplified ICT risk management framework


• Second batch of Regulatory Technical Standards (RTS) and Implementing Technical Standards (ITS) from 17.7.2024:
• RTS on harmonizing conditions enabling oversight
• RTS specifying criteria for determining the composition of the Joint Investigation Team (JET)
• RTS on Threat-Led Penetration Testing (TLPT)
• RTS and ITS on content, format, templates, and deadlines for reporting major ICT-related incidents and significant cyber threats
• Guidelines for estimating aggregate costs/losses caused by major ICT-related incidents
• Guidelines for supervisory cooperation