DORA compliance,built for financial sector resilience.
DORA applies to over 22,000 financial entities across the EU. ONTRACE.AI will manage your ICT risk framework, incident classification, third-party provider oversight, and resilience testing programmes — autonomously.
Framework Overview
What is DORA?
The Digital Operational Resilience Act (EU 2022/2554) is an EU regulation that entered into force on 17 January 2025. It establishes a comprehensive framework for ICT risk management, incident reporting, resilience testing, and third-party risk management specifically for the EU financial sector.
DORA consolidates and supersedes existing ICT risk guidelines from EBA, ESMA, and EIOPA, creating a single, harmonised framework. It applies directly to financial entities and — uniquely — creates regulatory oversight of critical ICT third-party service providers.
Unlike most frameworks, DORA's direct regulation of technology providers means cloud platforms, managed service providers, and SaaS vendors serving EU financial entities may themselves fall under direct regulatory supervision.
Covered Entities
The Five Pillars of DORA
Digital resilience across your entire ICT landscape.
ICT Risk Management
A comprehensive ICT risk management framework — governance, strategy, policies, and continuous risk assessment for all ICT assets.
ICT Incident Management
Classify, manage, and report ICT-related incidents. Major incidents must be reported to regulators within strict timeframes.
Digital Operational Resilience Testing
Annual basic testing for all entities, with Threat-Led Penetration Testing (TLPT) required every 3 years for significant institutions.
Third-Party ICT Risk
Strict requirements for managing ICT third-party service providers — contractual requirements, concentration risk, and oversight.
Information Sharing
Financial entities are encouraged to share cyber threat intelligence and information on vulnerabilities within trusted communities.
Available Now
ISO 27001 forms a strong foundation for DORA's ICT risk management pillar.
DORA's ICT risk management framework (Pillar 1) closely mirrors ISO 27001's approach to information security risk management. Financial entities already certified to ISO 27001 are significantly ahead in their DORA compliance journey.