Digital operational resilience

DORA: ICT risk, incidents, resilience testing and ICT third-party providers for financial entities

Governance (Art. 5), ICT incidents (Arts. 17-19) and ICT third-party providers (Art. 28): what the regulation requires and what evidence the supervisor needs.

Let's talkStarting assessment

DORA has applied to EU financial entities since 17 January 2025. It requires an ICT risk-management framework approved by the management body, classification and reporting of major ICT-related incidents, resilience testing and close control of ICT third-party providers, including the register of information.

Who it applies to

  • Banks, payment and e-money institutions, investment firms, insurers and reinsurers.
  • Fund managers, crypto-asset service providers, trading venues and other entities listed in Article 2.
  • Critical ICT third-party providers, subject to dedicated EU oversight.

What it requires

  1. 01

    ICT risk-management framework

    Documented strategies, policies and procedures, approved and reviewed by the management body.

  2. 02

    ICT incidents

    A handling process, classification under common criteria and reporting of major incidents to the authority.

  3. 03

    Resilience testing

    A proportionate testing programme and, for some entities, threat-led penetration testing (TLPT).

  4. 04

    ICT third-party risk

    Register of information on ICT contracts, mandatory contractual provisions and exit strategies.

  5. 05

    Continuity and recovery

    ICT business continuity policies, response and recovery plans, backups.

  6. 06

    Information sharing

    Arrangements to exchange cyber threat information among financial entities.

Timeline

  1. 16 Jan 2023Regulation enters into force.
  2. 17 Jan 2025Application for financial entities.
  3. 2025First submissions of the register of information to the authorities.

EVIDEVO

How EVIDEVO manages controls and evidence for DORA

ICT providers and the register of information

In Vendor management, contracts, supported functions, assessments and clauses are linked to the register of information data (Art. 28).

Controls shared with NIS2 and ISO/IEC 27001

A control common to the three frameworks has a single set of evidence, linked to each requirement.

Tests with owner, date and outcome

Every resilience test has an owner, a date, an outcome and the corrective actions that follow.

Management body reporting

The status of the ICT risk-management framework is summarised in a report for the management body, which approves and reviews it (Art. 5).

Data for illustrative purposes only, not real

What can be exported

  • Data for the register of information
  • Evidence of the ICT risk-management framework
  • History of tests and corrective actions

Capabilities for DORA

How to determine whether DORA applies

Sector, size and services define the scope. The starting assessment identifies it and sets the priorities.

Starting assessment

Guides on DORA

Frameworks that share evidence

Informational summary, updated October 2026. Not legal advice: applicability and obligations should be checked against the official text and the specific case.

A thirty-minute presentation based on the organisation's scope.

It starts from the frameworks in scope and how the work is organised today. In thirty minutes, EVIDEVO is shown working in that context.

Let's talk