DORA is a test of how you operate, not a mapping exercise.

Five areas, one regulation.

DORA (Regulation (EU) 2022/2554) pulls the pieces of operational resilience into a single, directly applicable rulebook. Its requirements fall into five areas.

1. An ICT risk-management framework owned by the management body.Resilience is the board’s responsibility, not something delegated wholesale to IT.
2. ICT incident management, classification and major-incident reporting.A defined process to detect, classify and report the incidents that matter.
3. Digital operational resilience testing, including threat-led penetration testing (TLPT) for significant entities.Regular testing, with TLPT expected of the entities that carry the most weight.
4. ICT third-party risk management, including a maintained register of information.A single register covering all ICT third-party arrangements, kept current.
5. Information and intelligence sharing.Arrangements to exchange cyber threat information across the sector.

Supervisors want proof it works, not proof it was written down.

Where firms trip

• Treating DORA as a one-off gap-mapping exercise, then moving on.
• A register of information that is incomplete, or already stale.
• Concentration risk sitting in a handful of cloud and ICT providers.
• Incident classification that exists on paper but isn’t operational.
• Testing that never gets near threat-led.