DORA Compliance Consulting
We help EU financial entities meet DORA requirements for ICT risk management, incident reporting, resilience testing and third-party risk, with tailored support for critical ICT service providers.
DORA sets digital operational resilience requirements for the EU financial sector. Passeca helps organisations assess their obligations, strengthen ICT risk management, establish incident reporting procedures, plan resilience testing and manage ICT third-party risks.
We use Hyperproof, a Governance, Risk and Compliance (GRC) platform, to centralise evidence, track compliance progress and manage regulatory requirements in one place.
What is DORA?
DORA (the Digital Operational Resilience Act, Regulation (EU) 2022/2554) is an EU regulation that establishes a single, binding framework for digital operational resilience in the financial sector. It aims to ensure that financial entities can withstand, respond to and recover from all types of ICT-related disruptions and threats. It is directly applicable in all member states without national transposition.
DORA has applied since 17 January 2025 to a wide range of financial entities, including banks, payment institutions, investment firms, insurers and crypto-asset service providers. Critical Information and Communication Technology (ICT) third-party service providers designated by the European Supervisory Authorities (ESAs) are also subject to a dedicated oversight framework.
Who needs DORA compliance?
- You are an EU financial entity. Banks, payment institutions, e-money issuers, investment firms, insurers, CCPs, trading venues and credit rating agencies.
- You are a crypto-asset service provider. CASPs are explicitly in scope of DORA.
- You are a critical ICT third-party provider. Cloud platforms, data centres and other ICT providers designated as critical fall under ESA oversight.
- You rely on ICT to deliver financial services. If your organisation falls within DORA's scope, you must meet the applicable digital operational resilience requirements to manage ICT-related risks and disruptions.
What does DORA actually require?
DORA is organised around five pillars. Together they require a financial entity to manage ICT risk comprehensively, report major incidents quickly, test its resilience, govern its ICT suppliers, and share intelligence — all under board-level accountability.
- ICT risk management (Art. 5–15) — an ICT risk-management framework with defined roles, risk identification, protection (access control, cryptography, change management), detection, response and recovery, approved by the management body.
- ICT-related incident reporting (Art. 17–23) — a process for classifying, logging and reporting major ICT-related incidents to the competent authority on a defined timeline.
- Digital operational-resilience testing (Art. 24–27) — a programme of security and resilience tests, from vulnerability assessments and basic testing to advanced Threat-Led Penetration Testing (TLPT) for financial entities required to undergo it.
- ICT third-party risk (Art. 28–44) — maintaining a register of information on ICT service contracts, assessing provider risks, including required contractual clauses and planning exit strategies. Critical ICT third-party service providers designated by the European Supervisory Authorities (ESAs) are subject to direct oversight.
- Information sharing (Art. 45) — financial entities may voluntarily participate in trusted arrangements to exchange information about cyber threats and vulnerabilities.
The framework is supported by regulatory technical standards (RTS) and implementing technical standards (ITS) published by the ESAs, which add granular detail on reporting templates, the register of information, and testing programmes.
How Passeca gets you DORA compliant
- 01
ICT scope & entity classification
We assess whether your organisation falls within DORA's scope and identify which requirements, regulatory technical standards (RTS) and other applicable rules you must follow.
- 02
ICT risk-management gap analysis
We assess your framework against the Article 5–15 requirements — governance, identification, protection, detection, response and recovery — and rank the gaps by regulatory and operational risk.
- 03
Incident reporting & resilience testing plan
We design the major-ICT-related-incident reporting process to meet DORA timelines, and build the operational-resilience testing programme — from basic testing through to TLPT for systemic entities.
- 04
ICT third-party risk implementation
We identify your ICT third-party service providers, review contracts against DORA requirements, establish the register of information and use Panorays to support continuous third-party risk monitoring — see our Third-Party Risk service.
- 05
Evidence, testing & ongoing assurance
We capture evidence in Hyperproof mapped to the DORA articles, run or facilitate the required testing (including TLPT where applicable), and provide ongoing assurance ahead of regulatory inspection.
What you get from the engagement
How long does DORA compliance take?
| Entity profile | Estimated timeline | What affects the timeline |
|---|---|---|
| Financial entity not selected for TLPT | 4–8 months | Implementing applicable ICT risk management, incident reporting, resilience testing and third-party risk requirements. |
| Financial entity required to conduct TLPT | 9–18 months | Planning and conducting threat-led penetration testing (TLPT), addressing identified weaknesses and implementing other applicable DORA requirements. |
| Designated critical ICT third-party service provider | 6–12 months | Preparing for oversight by the European Supervisory Authorities (ESAs), including relevant risk management, documentation and oversight requirements. |
Passeca prioritises the register of information and incident-reporting procedures, as both are important DORA compliance requirements.
Doing more than one framework?
| DORA | NIS2 | ISO 27001 | |
|---|---|---|---|
| ICT risk management | |||
| Incident reporting | Implicit | ||
| Resilience testing / TLPT | Implicit | Pentest | |
| Third-party / register of info | |||
| Nature | EU regulation | EU directive | Voluntary standard |
| For financial entities | Primary | Largely excluded | Baseline |
For financial entities within DORA's scope, DORA generally takes precedence over corresponding NIS2 requirements for ICT risk management and incident reporting. ISO 27001 provides a recognised information security management framework that can help organisations support relevant DORA and NIS2 requirements. Passeca uses Hyperproof to organise and reuse evidence across applicable requirements, reducing duplicate work.
DORA compliance, answered
What is DORA?
Who is in scope of DORA?
What are the five pillars of DORA?
What is a TLPT and who needs one?
What is the DORA register of information?
Does DORA replace NIS2 for financial entities?
When did DORA take effect?
Get Ready for DORA Compliance
Speak with our experts about your DORA requirements, current readiness and the steps needed to strengthen your organisation's digital operational resilience.
Related