DORA is the Digital Operational Resilience Act, Regulation (EU) 2022/2554. It sets common rules across the EU so that financial entities can withstand, respond to and recover from ICT disruptions and cyberattacks. It has applied directly since 17 January 2025.

Who must comply with DORA?

Financial entities, such as banks, insurers, investment firms and payment providers, and the ICT service providers they depend on. Because it is a regulation, it applies directly in every Member State, without national transposition.

What is digital operational resilience?

It is the ability to keep critical functions running, and to recover, despite disruption to the ICT systems they depend on. That includes cyberattacks, but also failures, errors and problems at third-party providers.

What are the main areas of DORA?

• ICT risk management: a documented framework to identify, protect against, detect and respond to ICT risk.
• Incident reporting: classification and reporting of major ICT-related incidents to authorities.
• Resilience testing: regular testing of systems and defences.
• Third-party risk: control over ICT providers, with oversight of those that are critical.
• Information sharing: exchange of threat information between financial entities.

What does DORA say about identity and access?

The ICT risk management framework is expected to include information security policies, procedures and access controls. In practice that means knowing who and what has access to critical systems, limiting it to what is needed, protecting it with strong authentication and being able to show that it is reviewed.

What are the DORA incident reporting requirements?

Major ICT-related incidents are reported to the competent authority in stages: an initial notification, an intermediate report and a final report, using standard templates. To report well, an organisation needs to scope an incident quickly, including which accounts were involved and what they did.

What does DORA expect on third-party risk?

Financial entities remain responsible for services they outsource. DORA expects contractual safeguards, a register of ICT third-party arrangements, due diligence and exit strategies, and it places the most critical ICT providers under direct oversight. For identity, this includes knowing which supplier accounts have access to your systems and what they can do.

What does resilience testing involve?

Regular testing of systems and defences, from vulnerability assessments to scenario-based tests. Some entities must also carry out advanced testing that simulates realistic attacks on live systems. Identity paths, such as privileged and supplier accounts, are a natural focus.

Why does management accountability matter?

Under DORA the management body is responsible for the ICT risk management framework. Leaders need a clear, current view of risk, including identity risk, and not only a policy on paper.

How is DORA different from NIS2?

NIS2 is a directive that covers essential and important entities across many critical sectors and is transposed into national law. DORA is a regulation focused on finance and directly applicable. Financial entities should check how the two interact under the rules that apply to them.

How can identity security support DORA?

Continuous visibility on identities and privileges supports access control. Monitoring after login supports detection. Fast investigation supports incident scoping and reporting. Reports and records support audit evidence.

How should you prepare for DORA?

Map the critical functions and the identities behind them, review who and what has access, define how incidents are classified and reported, and make sure evidence is available without a manual scramble before every review.

Sharelock supports monitoring and alignment with DORA by showing who has access to what and how identities behave across critical applications. No tool alone makes an organisation compliant, and DORA does not come with a certification mark.

‍