Information security
DORA
Digital Operational Resilience Act (DORA)
DORA is the European Union regulation that sets common rules for the digital operational resilience of the financial sector. We help you close the gaps across ICT risk, incident reporting, testing and third-party oversight, and demonstrate compliance.
What DORA is
The Digital Operational Resilience Act is European Union law that requires financial entities to withstand, respond to and recover from ICT-related disruptions. It brings ICT risk management, incident classification and reporting, operational resilience testing, and the oversight of ICT third-party providers under one harmonised framework.
DORA is a regulation you demonstrate compliance with, supervised by the relevant financial authorities, rather than a standard an accredited body certifies you against. Its obligations apply across a broad range of financial entities and, through contractual and oversight provisions, reach the ICT providers that serve them.
The five pillars of DORA
Pillar 1 · ICT risk management
Financial entities must maintain a governed framework of strategies, policies and tools to identify, protect against and recover from ICT risks, with ultimate accountability resting on the management body.
Pillar 2 · Incident reporting
Major ICT-related incidents must be classified against defined criteria and reported to the relevant competent authority through initial, intermediate and final notifications on set timelines.
Pillar 3 · Digital operational resilience testing
Entities must run a proportionate testing programme, and the most significant ones must carry out threat-led penetration testing at least every three years.
Pillar 4 · ICT third-party risk management
Contracts with ICT service providers must meet mandated terms, be captured in a register of information, and critical providers fall under a dedicated European oversight regime.
Pillar 5 · Information sharing
The regulation enables financial entities to exchange cyber threat intelligence and indicators among trusted communities on a voluntary basis.
Technical standards · RTS and ITS
The high level obligations are given operational detail through Regulatory and Implementing Technical Standards developed by the European Supervisory Authorities.
Who needs it
- Banks, insurers, investment firms and other regulated financial entities operating in the EU
- Payment, e-money and crypto-asset service providers within scope of EU financial rules
- ICT third-party providers whose services support financial entities in the EU
What you get
- A gap assessment and prioritised roadmap against the DORA requirements
- An ICT risk management framework with incident classification and reporting processes
- A register of ICT third-party arrangements and a resilience testing programme
- A compliance evidence pack and readiness for supervisory engagement
Timelines depend on how DORA applies to you, the maturity of your ICT risk and third-party arrangements and the scale of your estate. We scope it honestly up front rather than promise a fixed number of weeks.
Current version
DORA entered into force in January 2023 and has applied in full since 17 January 2025, so in-scope financial entities and their ICT providers are now expected to meet its obligations rather than prepare for them. The detailed requirements continue to be shaped by Regulatory and Implementing Technical Standards and by supervisory guidance from the European Supervisory Authorities, several of which were finalised around and after the application date. The practical transition task is keeping your framework, register of information and incident processes aligned as those standards settle and as competent authorities clarify their expectations.
What it costs
DORA is a regulation you demonstrate compliance with to your supervisory authority, not a standard with a certificate to buy, so there is no accredited certification fee attached to it. The costs that sit side by side are our scoped advisory and implementation fee, quoted up front once we understand your size, scope and starting point, and any independent input you choose to add, such as a threat-led or technical resilience test, an external audit, or legal and specialist advice on how the obligations apply to you. tr3labs is never your certifier, auditor or regulator. We scope the work with you rather than quote blind.
How tr3labs gets you there
Scope and gap assessment
We confirm how DORA applies to you, map your current ICT risk management, incident, testing and third-party arrangements against its requirements, and hand you a prioritised roadmap.
Build the framework
We help you implement the ICT risk management framework, incident classification and reporting processes, and the third-party risk and register requirements the regulation expects.
Resilience testing and evidence
We bring security testing and reviews to support your operational resilience testing programme and assemble the evidence that shows the framework is operating.
Readiness and supervisory support
We prepare you to demonstrate compliance to your supervisory authority and keep the framework current as the technical standards under DORA evolve.
DORA and ISO 27001 compared
Both deal with ICT and information security risk, so firms often assume meeting one satisfies the other.
| DORA | ISO 27001 | |
|---|---|---|
| Covers | Digital operational resilience of EU financial entities | Information security management for any organisation |
| Who asks for it | EU financial regulators and supervisory authorities | Customers, partners and procurement teams |
| Core idea | A legal obligation across five resilience pillars | A certifiable management system standard |
| Audit model | Supervisory oversight, no certificate | Independent accredited certification body |
| Scope of reach | Financial entities and their ICT third parties | Any organisation, voluntary adoption |
| Often held with | ISO 27001 as a control baseline | DORA, NIS2 and sector regulations |
DORA FAQ
- How much does DORA compliance cost?
- DORA is a regulation you demonstrate to your supervisory authority, not a certificate to buy. You pay our scoped advisory and implementation fee, quoted up front, plus any independent input you choose, such as a threat-led resilience test, an external audit, or specialist legal advice.
- How long does DORA compliance take?
- It depends on how DORA applies to you, the maturity of your ICT risk and third-party arrangements and the scale of your estate. We scope the timeline honestly up front rather than promise a fixed number of weeks.
- Does DORA apply to ICT providers as well as financial firms?
- Yes. DORA places direct obligations on financial entities and reaches ICT third-party providers through contractual requirements, and critical providers can fall under a dedicated oversight regime. We help you establish how it applies to you during scoping.
- Is DORA a certification?
- No. It is an EU regulation you demonstrate compliance with to your supervisory authority, not a certifiable standard. We build the framework and evidence and prepare you for supervisory engagement.
- How does DORA relate to ISO 27001?
- A mature information security management system gives you a strong base, but DORA adds specific obligations on incident reporting, resilience testing and ICT third-party oversight. We map what you already have and close the DORA-specific gaps.
Related standards
Related reading
The OWASP LLM Top 10, Explained: A Plain-English Guide for Teams Shipping AI Features
A clear, practical walkthrough of the OWASP Top 10 risks for large language model applications, with a plain-English description and a concrete mitigation for each, aimed at teams adding AI features for the first time.
9 min read
How to Read a Penetration Test (VAPT) Report: A Plain-English Guide for Teams
A practical walkthrough of what goes into a penetration test report, section by section, so founders and engineering teams can read one with confidence and act on what it says.
8 min read
SOC 2 vs ISO 27001: an honest comparison to help you choose
A plain-English guide to the real differences between SOC 2 and ISO 27001: what each one is, who asks for which, how the audits work, what you end up holding, and whether you should do both.
8 min read