--- title: "DORA: The Digital Operational Resilience Act" description: The Digital Operational Resilience Act is a European framework that establishes a uniform approach regarding the security integrity of the information and communication technology (ICT) systems processed by participants in the financial markets within the European Union’s jurisdiction. image: https://csacyber.com/hubfs/DORA-blog-thumbnail-770x400.png --- [Skip to content](https://csacyber.com/blog/dora-the-digital-operational-resilience-act#main-content) [![CSA Cyber - Cyber Security Solutions to Protect your People](https://csacyber.com/hs-fs/hubfs/CSA%20Cyber%20Logo%20FNL_Full%20Logo.png?width=300&height=108&name=CSA%20Cyber%20Logo%20FNL_Full%20Logo.png "CSA Cyber - Cyber Security Solutions to Protect your People")](https://csacyber.com/) - Services - [Offensive Security Services](https://csacyber.com/offensive-security-services) - [Penetration Testing](https://csacyber.com/penetration-testing) - [Red Teaming and attack simulations](https://csacyber.com/offensive-security-services#red-teaming) - [Continuous testing](https://csacyber.com/offensive-security-services#continuous-assurance) - [Managed offensive security](https://csacyber.com/offensive-security-services#managed-offensive) - [Consultancy Services](https://csacyber.com/cyber-consultancy-services) - [Frameworks & assessments](https://csacyber.com/cyber-consultancy-services/frameworks-and-assessments) - [Data protection](https://csacyber.com/cyber-consultancy-services#data-protection) - [Virtual leadership](https://csacyber.com/cyber-consultancy-services#virtual-leadership) - [Technical security consulting](https://csacyber.com/cyber-consultancy-services#technical-consultancy) - [Governance, Risk & Compliance (GRC)](https://csacyber.com/cyber-consultancy-services/governance-risk-and-compliance-services) - [Extended Managed Security Services](https://csacyber.com/extended-managed-security-services) - [Microsoft Sentinel SIEM](https://csacyber.com/extended-managed-security-services#microsoft-sentinel) - [SOC services](https://csacyber.com/extended-managed-security-services#soc-services) - [SentinelOne Endpoint Detection & Response (EDR)](https://csacyber.com/extended-managed-security-services#cyber-helpdesk) - [Incident Response Services](https://csacyber.com/incident-response-services) - [Emergency Incident Response](https://csacyber.com/urgent/emergency-incident-response) - [Incident Response Retainer](https://csacyber.com/incident-response-services) - [Cyber Incident Readiness & Response Planning](https://csacyber.com/incident-response-services) - [Tabletop Exercises & Live-Range Engagements](https://csacyber.com/incident-response-services) - [Specialist Security Services](https://csacyber.com/specialist-services) - [AI Security](https://csacyber.com/cyber-services-for-ai) - [Operational Technology (OT)](https://csacyber.com/specialist-services#operational-technology) - [Cyber security for Private Equity](https://csacyber.com/specialist-services#mergers-and-acquisitions) - [Cyber training and education](https://csacyber.com/specialist-services#training-and-education) - [Virtual leadership](https://csacyber.com/specialist-services#leadership) - [Cyber Technologies](https://csacyber.com/cyber-technologies) - [SentinelOne Endpoint Detection & Response (EDR)](https://csacyber.com/cyber-technologies#sentinelone) - [AppGuard Endpoint & Server Zero Trust Protection](https://csacyber.com/cyber-technologies#appguard) - [Qualys Vulnerability Management as a Service (VMaaS)](https://csacyber.com/cyber-technologies#qualys-vmaas) - [Lookout Mobile Device Protection](https://csacyber.com/cyber-technologies#lookout) - [ThreatER DNS Protection](https://csacyber.com/cyber-technologies#threater-dns) - [Cyber Security Awareness & Training platform](https://csacyber.com/cyber-technologies#boxphish) - [About](https://csacyber.com/about-us) - [Careers](https://csacyber.com/careers) - [Certifications](https://csacyber.com/certifications-and-awards) - [Blog](https://csacyber.com/blog) - [Support Centre](https://csacyber.com/support) - Resources - [Case Studies](https://csacyber.com/case-studies) - [Downloads & Reports](https://csacyber.com/downloads-and-reports) - [Webinars](https://csacyber.com/webinars) - [Partners](https://csacyber.com/partners) - [Cyber Bundles (IT MSPs)](https://csacyber.com/cyber-bundles) - [Contact](https://csacyber.com/contact-us) - Search Search Search July 30, 2024 4 min read time # DORA: The Digital Operational Resilience Act ![Henry Kibirige](https://app.hubspot.com/settings/avatar/d41d8cd98f00b204e9800998ecf8427e) [Written by: Henry Kibirige -](https://csacyber.com/blog/author/henry-kibirige) [Consultancy](https://csacyber.com/blog/tag/consultancy) ![](https://csacyber.com/hubfs/DORA-blog-thumbnail-770x400.png) ### What is DORA?  The Digital Operational Resilience Act is a European framework that establishes a uniform approach regarding the security integrity of the information and communication technology (ICT) systems processed by participants in the financial markets within the European Union’s jurisdiction. ### Why is it relevant/the context? DORA aims to keep pace with increased digitisation and the use of ICT within financial markets. The increased digitisation across the financial system has amplified ICT risk without respective scrutiny on the operational resilience of the systems and processes in place. Digitisation within the financial sector has reached a point where ICT systems are critical to the delivery of daily operations, whereas in the past some actions such as payments and securities clearing through to back-office activities were cash or paper based. It has also extended and deepened the inter-connected relationship with insurance organisations and intermediaries. As such, the risk of an isolated incident spreading faster and posing a greater threat is more likely, resulting in potential systemic risk to the industry. In order to maintain faith in the financial markets and uphold investor confidence, the EU has recognised the need to implement a common approach to sustaining operational resilience. ### Who is impacted by it? More than 22,000 organisations will be impacted by DORA. The regulation is applicable to a wide range of entities, outside of purely critical financial entities, that may not have previously been mandated to focus on specific or prescriptive security measures by a previous directive. Organisations that will be applicable to DORA include key financial entities, namely, credit and payment institutions, electronic money institutions, investment firms, central securities depositories, crowdfunding service providers as well as third-party ICT service providers, crypto-asset service providers, insurance providers and intermediaries. A full list is outlined in the Regulation (EU) 2022/2554 (DORA). To keep pace with technological advancements as participants take up new digital services, a broad definition has been applied to ICT. ##### What does the Framework entail? The regulations can be broken down into the following key areas: **1) ICT Risk Management** Organisations must have a sound, comprehensive and well-documented risk management framework. Furthermore, ICT processes, tools and protocols must be in place to identify, detect and respond to ICT related risks. **2) ICT related Incident Management** Incident management is a critical aspect of any organisation and its importance is reflected within the regulation. Processes must be in place to handle incidents when they arise, covering the initial identification stage, all the way through to documenting any lessons learned. There must also be ways in which organisations classify incidents based on their criticality. **3) Digital Operational Resilience Testing** Operational resilience testing is about testing the organisation’s infrastructure for vulnerabilities that can be exploited, as well as areas that can be improved upon. The regulations require that organisations adopt a risk-based approach and complete tests at regular intervals. Any significant issues raised should be documented and acted upon in a timely manner. **4) Information Sharing Arrangements** It is important that an organisation is aware of the inherent risks that can come from the ICT supply chain that it operates with. Processes must be in place to manage and monitor these relationships effectively. Furthermore, organisations should ensure that contractual agreements with third-parties provide sufficient protection on matters such as security incidents, data breaches and data integrity. **5) ICT Third Party Risk Management** Finally, organisations must have arrangements in place to share cyber threat information and intelligence with other entities. Information sharing is a powerful way of sharing best practices and alerting others about unknown issues. **The deadline and the importance of acting now** DORA came into force on the 16th January 2023, although organisations will be required to be compliant from the 17th January 2025. **Cyber Security Associates’ View:** DORA will act as a trigger for organisations to reassess ongoing projects and assess how they relate to the framework and ensure operational resiliency. This could amount to a large amount of due diligence work and adjustments to current and upcoming projects impacting time and cost. It will also impact existing and new contracts between financial entities and ICT providers that will need to be adjusted to insert contractual obligations outlined in DORA. This will involve re-assessment of all relevant live contracts and scrutiny of new engagements, requiring additional support for in-house legal and compliance or specialist third-party support. Additionally, organisations will need to have closer interaction and time spent assessing their supply chain and implementing measures to ensure risk mitigation. Third-party risk management would also need to align to emerging regulation requirements. DORA also increases the scope of organisations that now need to critically think about their operational resilience and third-party supply chain. Firms like Crypto-currency asset providers, intermediaries and even cloud-service providers weren’t previously subject to such extensive regulatory requirements. ##### What should you do about it? Organisations should follow similar risk-based approaches to DORA as other frameworks and risk mitigation activities and base it on their size, risk profile and nature of business. Smaller and micro-entities may have simplified requirements compared to larger financial entities. Aspects such as advanced digital resilience testing may only be applicable to a small percentage of organisations operating within the EU. Additionally, aspects such as incident reporting, which some organisations would have previously reported through other directives (such as Directive (EU) 2015/2366 of the European Parliament) are now pursuant to this regulation. Therefore, it is imperative to understand what aspects of the DORA framework are relevant to the organisation and what activities need to be conducted. CSA strongly advises conducting a gap analysis and maturity assessment against the framework and existing measures and processes already in place that could align. [Quick Reference Guide Download](https://csacyber.com/hubfs/Introduction%20to%20DORA%20-%20Guide%20-%20CSA%20Cyber.pdf) ##### Get in touch Cyber Security Associates, founded in 2006 is a leading security consulting and governance and risk practice. In addition, CSA has a market leading SOC service built around Microsoft’s technology stack. CSA delivers a variety of services to FTSE 100, Fortune 500 companies, including a myriad of financial entities, through to SMEs and public sector and governmental organisations. We have a trusted team of qualified consultants with experience across various frameworks and risk management practices, including DORA. For more information on DORA or CSA’s wider security capabilities please get in touch via our website - [Contact Us](https://csacyber.com/contact-us) Related Posts ## You may also like this [Similar Articles](https://csacyber.com/blog) [![](https://csacyber.com/hs-fs/hubfs/20230510-N1005919-Edit1.jpg?width=624&height=427&name=20230510-N1005919-Edit1.jpg)](https://csacyber.com/blog/fluidone-group-appoints-charly-davis-as-managing-director-of-csa-cyber-to-advance-its-security-first-strategy) August 24, 2026 2 min read ### [FluidOne Group appoints Charly Davis as Managing Director of CSA Cyber to advance its security-first strategy](https://csacyber.com/blog/fluidone-group-appoints-charly-davis-as-managing-director-of-csa-cyber-to-advance-its-security-first-strategy) Experienced industry leader joins FluidOne to strengthen integrated cyber, IT and secure networking... [![CSA Cyber](https://csacyber.com/hs-fs/hubfs/CSA%20Cyber%20Logo%20FNL_Stacked.png?width=40&height=40&name=CSA%20Cyber%20Logo%20FNL_Stacked.png) CSA Cyber](https://csacyber.com/blog/author/csa-cyber) [![](https://csacyber.com/hs-fs/hubfs/Untitled%20design.jpg?width=624&height=427&name=Untitled%20design.jpg)](https://csacyber.com/blog/csa-cyber-and-fluidone-named-as-suppliers-on-g-cloud-15) August 20, 2026 2 min read ### [CSA Cyber and FluidOne named as suppliers on G-Cloud 15](https://csacyber.com/blog/csa-cyber-and-fluidone-named-as-suppliers-on-g-cloud-15) CSA Cyber (CSA), part of the FluidOne Group, has been named as a supplier on Government Commercial... [![CSA Cyber](https://csacyber.com/hs-fs/hubfs/CSA%20Cyber%20Logo%20FNL_Stacked.png?width=40&height=40&name=CSA%20Cyber%20Logo%20FNL_Stacked.png) CSA Cyber](https://csacyber.com/blog/author/csa-cyber) [![](https://csacyber.com/hs-fs/hubfs/Engineered%20to%20Endure%20Campaign%20Assets%20(2).png?width=624&height=427&name=Engineered%20to%20Endure%20Campaign%20Assets%20(2).png)](https://csacyber.com/blog/why-organisations-lose-security-visibility-without-realising-it) August 20, 2026 6 min read ### [Why organisations lose security visibility without realising it](https://csacyber.com/blog/why-organisations-lose-security-visibility-without-realising-it) Before an organisation can understand risk, maintain control or respond effectively to emerging... [![CSA Cyber](https://csacyber.com/hs-fs/hubfs/CSA%20Cyber%20Logo%20FNL_Stacked.png?width=40&height=40&name=CSA%20Cyber%20Logo%20FNL_Stacked.png) CSA Cyber](https://csacyber.com/blog/author/csa-cyber) [![CSA Cyber Logo FNL_Full Logo](https://csacyber.com/hs-fs/hubfs/CSA%20Cyber%20Logo%20FNL_Full%20Logo.png?width=3463&height=1248&name=CSA%20Cyber%20Logo%20FNL_Full%20Logo.png "CSA Cyber Logo FNL_Full Logo")](https://csacyber.com/) Established in 2013, Cyber Security Associates Limited trading as CSA Cyber provides cyber consultancy and cyber managed services which help to detect, protect and educate against the ever-changing cyber threat. We have built our team from a foundation of Government (ex-Military) and Commercially experienced specialists all holding current and relevant cyber certifications. Today our core services are based around a 24/7 Security Operations Centre (SOC) based in Gloucester. #### News & Resources - [Blog](https://csacyber.com/blog) - [Case Studies](https://csacyber.com/case-studies) - [Downloads & Reports](https://csacyber.com/downloads-and-reports) - [Webinars](https://csacyber.com/webinars) - [Careers](https://csacyber.com/careers) - [Cyber Bundles (IT MSPs)](https://csacyber.com/cyber-bundles) #### Quick Links - [About Us](https://csacyber.com/about-us) - [Certifications](https://csacyber.com/certifications-and-awards) - [Our Parent Company](https://www.fluidone.com) - [Partners](https://csacyber.com/partners) - [Contact Us](https://csacyber.com/contact-us) - [Anti Bribery Policy](https://csacyber.com/hubfs/CSAAnti-BriberyPolicy.pdf) - [Complaints Policy](https://csacyber.com/hubfs/CSAComplaintsPolicy.pdf) - [Corporate Social Responsibility Policy](https://csacyber.com/hubfs/CSACorporateSocialResponsibilityPolicy.pdf) - [Slavery and Human Trafficking Statement](https://csacyber.com/hubfs/CSASlaveryandHumanTraffickingStatement.pdf) - [NCSC CHECK Status Verification](https://www.ncsc.gov.uk/organisation/csa-cyber/check-penetration-testing) - [CREST Approved Certification Verification](https://www.crest-approved.org/member_companies/csa-cyber/) #### Contact Information **United Kingdom - London** Cyber Security Associates Ltd 5 Hatfields, London, SE1 9PG   **United Kingdom - Gloucester** Cyber Security Associates Ltd Unit 11, Wheatstone Court, Waterwells Business Park, GL2 2AQ   **Phone:** [+44(0) 300 303 4691](tel:03003034691) **Email:** [hello@csacyber.com](mailto:hello@csacyber.com)   **United States of America** Cyber Security Associates Inc. 6010 W. Spring Creek Pkwy, Plano, Texas, 75024   **Phone:** [+1 469 750 1695](tel:14697501695)  **Email:** [hello@csacyber.com](mailto:hello@csacyber.com)   [![trust-pilot](https://csacyber.com/hs-fs/hubfs/trust-pilot.png?width=178&height=104&name=trust-pilot.png)](https://uk.trustpilot.com/review/csa.limited)   --- - [Website Terms of Use](https://csacyber.com/website-terms-of-use) - [Website Privacy Policy](https://csacyber.com/privacy-notice) - [Website Cookie Policy](https://csacyber.com/cookie-policy) Copyright 2026. Cyber Security Associates Ltd [Follow us on Facebook](https://www.facebook.com/CSALIMITED/) [Follow us on LinkedIn](https://www.linkedin.com/company/csa-cyber/) [Follow us on Twitter](https://twitter.com/cybersecurityis) [Follow us on Facebook](https://www.youtube.com/@cybersecurityassociateslim) [Follow us on Facebook](https://www.instagram.com/cybersecurityassociates) ```json { "@context" : "https://schema.org", "@type" : "BlogPosting", "author" : { "@type" : "Person", "name" : "Henry Kibirige", "url" : "https://csacyber.com/blog/author/henry-kibirige" }, "dateModified" : "2025-01-16T08:45:16.339Z", "datePublished" : "2024-07-30T04:15:00.000Z", "headline" : "DORA: The Digital Operational Resilience Act", "image" : [ "https://csacyber.com/hubfs/DORA-blog-thumbnail-770x400.png" ], "mainEntityOfPage" : { "@id" : "https://csacyber.com/blog/dora-the-digital-operational-resilience-act", "@type" : "WebPage" }, "publisher" : { "@type" : "Organization", "logo" : { "@type" : "ImageObject", "url" : "https://csacyber.com/hubfs/csacyber-logo-black-01.svg" }, "name" : "Cyber Security Associates Ltd" } } ```