DORA
The EU digital operational resilience requirements for financial entities and their ICT providers, with verbatim public-domain text.
What DORA is
The Digital Operational Resilience Act, Regulation (EU) 2022/2554, has applied since 17 January 2025. It is directly applicable EU law harmonising ICT risk requirements across the financial sector, replacing a patchwork of national and sectoral guidance with one regulation covering banks, insurers, investment firms, payment institutions, crypto-asset service providers, trading venues and a long tail of others.
It has five substantive pillars: ICT risk management, ICT-related incident management and reporting, digital operational resilience testing, ICT third-party risk management, and information sharing. The obligations that most often catch firms unprepared are the third-party ones — a mandatory register of information on all ICT service arrangements, specific contractual provisions that existing contracts usually lack, and an exit strategy for every critical or important function.
DORA also reaches beyond financial entities themselves. Critical ICT third-party providers can be designated for direct oversight by the European Supervisory Authorities, which is a materially different exposure from being a supplier subject to a customer's due diligence.
Who it applies to
- Financial entities established in the EU across essentially every regulated category — credit institutions, payment and e-money institutions, investment firms, insurers and intermediaries, crypto-asset service providers, trading venues, and more.
- ICT third-party service providers serving those entities, who inherit contractual obligations and may be designated critical.
- Non-EU firms serving EU financial entities, through the contractual requirements flowing down from their customers.
- Cloud and SaaS providers to financial services, where the register-of-information and exit-strategy requirements now shape the contract.
How it is structured in CMDash
CMDash seeds the key articles grouped by the regulation's pillars — ICT risk management, incident management, incident reporting, resilience testing and third-party risk — with sub-paragraphs expanded into individual rows where the article carries distinct obligations, so evidence attaches per obligation rather than per article.
| ICT Risk Management | 22 |
| Incident Management | 5 |
| Incident Reporting | 5 |
| Resilience Testing | 7 |
| Third-Party Risk | 8 |
These counts are the control rows CMDash actually seeds, checked against the seed files by a test on every build.
The control text
47 of the 47 seeded controls carry the publisher’s own wording, taken from Regulation (EU) 2022/2554 (DORA). It is public-domain content, so CMDash reproduces it rather than paraphrasing — you assess against what the publisher wrote.
What CMDash does for DORA
- Verbatim article text from Regulation (EU) 2022/2554, which is public-domain EU legislative content.
- Every seeded DORA article is mapped into the regulatory radar as a dated entry, which computes a readiness percentage against the regulation directly from your control statuses. DORA is the most completely mapped entry on the radar.
- A seeded crosswalk to NIST CSF, so ICT risk-management evidence reports alongside the rest of the security programme.
- The third-party pillar sits next to CMDash's vendor register, questionnaires, SBOM ingestion and continuous monitoring — the register-of-information obligation is a supplier inventory problem before it is a compliance problem.
- Every control is a tracked row with an owner, a status (not started, in progress, implemented, not applicable, at risk, failing), reviewer notes, and its own evidence requirements — not a checkbox on a spreadsheet.
- Evidence is uploaded against a specific control, dated, and kept on that control, so an assessor can see what was true when.
- Gaps export to a POA&M CSV — every control that is not implemented and not marked out of scope, with owner, status and evidence requirements.
- Policies you author in CMDash link to the controls they govern, so each control row shows which living policies stand behind it.
- A time-boxed, read-only external assessor seat can be scoped to just this framework, with an expiry date you set and a record of every page they opened.
What it shares with your other frameworks
CMDash seeds control-to-control crosswalk mappings, each with a confidence score. They are what stops the same artefact being gathered twice, and they are how a second framework costs a fraction of the first.
Where the evidence comes from
CMDash reads from the security tools you already run and turns what they report into control evidence. These are the integrations whose data lands closest to DORA’s control groups — you decide which control each signal evidences, and CMDash keeps it current from then on.
Where CMDash stops
Published on purpose. A buyer who discovers a limit after signing is a support ticket and a refund conversation; a buyer who reads it here is making an informed decision.
- The Regulatory Technical Standards and Implementing Technical Standards that give DORA its operational detail are not seeded as separate control sets, and the register of information has a prescribed reporting template that CMDash does not generate.
- Major-incident reporting to a competent authority has prescribed templates and deadlines. CMDash tracks the obligation and the evidence; it does not file the report.
- Threat-led penetration testing under the TLPT provisions is conducted by qualified external testers. CMDash records that it happened and holds the output.
- Nothing here is legal advice, and DORA applicability — particularly the proportionality provisions for smaller entities — is a legal determination.
Common questions
We are not an EU firm. Does DORA affect us?
Probably, if you sell ICT services to EU financial entities. The regulation obliges those entities to impose specific contractual terms on their ICT providers and to maintain a register of information covering every arrangement, so the obligations reach you through your customers' contracts even though you are not directly in scope.
Which pillar do firms underestimate?
Third-party risk, consistently. The register of information has to cover every ICT service arrangement with prescribed fields, existing contracts usually lack the required provisions, and every critical or important function needs a documented exit strategy. That is a contract-renegotiation programme, not a policy update.
Does CMDash file our incident reports?
No. Major-incident reporting runs to competent authorities on prescribed templates with hard deadlines. CMDash tracks the obligation, holds the evidence and shows readiness; the filing is yours.
Also in Privacy & Sector Regulation
Paid plans cap how many frameworks you run at once, never which ones — DORA is available on every paid plan.
View pricingReady to see your posture?
Start a 30-day free trial of any paid plan — a card is required, and it converts unless you cancel — or sign up for Free with no card at all.