DORA

DORA, Regulation (EU) 2022/2554 on digital operational resilience for the financial sector, establishes harmonised requirements for in-scope financial entities concerning ICT risk management, incidents, resilience testing, third-party risk and information sharing. It has applied since 17 January 2025. It also creates an EU oversight framework for ICT third-party service providers designated as critical; this does not mean every technology supplier is directly supervised or certified. Scope depends on the specific entity, service, function and contractual relationship. Compliance requires governance, evidence, registers, contracts and proportionate testing rather than purchase of one tool. Applicability and interpretation should be checked against the current official text and competent advice for each organisation, because a glossary summary cannot determine a particular legal obligation.