Andere Cookies sind konfigurierbar.
DORA: digital resilience the supervisor can test.
Regulation (EU) 2022/2554 has applied since 17 January 2025, binding financial entities and their critical ICT providers to five pillars of digital operational resilience. We implement all five with precision, from ICT risk frameworks to threat led testing readiness.
What does DORA require?
The Digital Operational Resilience Act, Regulation (EU) 2022/2554, is the EU's regime for the financial sector's resilience to ICT disruption. Applying since 17 January 2025, it binds banks, insurers, investment firms, payment institutions and a wide range of other financial entities, together with their critical ICT third party providers, to five pillars: ICT risk management, incident reporting, digital operational resilience testing, third party risk management and information sharing.
Unlike a directive, DORA applies directly, and it is built to be tested: supervisors expect a documented ICT risk framework owned by the management body, major incidents classified and reported on defined timelines, a proportionate testing programme rising to threat led penetration testing at least every three years for designated entities, and contractual and concentration control over critical ICT providers.
We help financial institutions and ICT providers meet those expectations with precision: assessing where you stand against each pillar, implementing the frameworks and processes, rehearsing the response, and preparing you for the audits, reviews and inspections that now come with the territory, connected to the cyber resilience and continuity capability DORA ultimately measures.
The five pillars, implemented
Where DORA sits in the architecture
DORA is the financial sector's lex specialis within a coordinated European architecture: NIS2 governs the other essential and important sectors, the CER Directive adds the physical and organisational dimension for critical entities, and Swiss groups carry the Information Security Act in parallel. The compliance calendar puts every regime's dates on one timeline, and our supply chain security practice covers the third party pillar in depth.
Häufig gestellte Fragen
Who does DORA apply to?+
A wide range of financial entities operating in the EU, including banks, insurers, investment firms, payment and e money institutions, crypto asset service providers and more, plus the ICT third party providers serving them, with critical providers subject to direct EU level oversight.
What is threat led penetration testing?+
TLPT is advanced testing in which realistic attack techniques are used against live production systems under controlled conditions, following the TIBER style approach. Designated entities must undergo it at least every three years; we prepare the scoping, governance and remediation around it.
How does DORA interact with NIS2?+
DORA is lex specialis for the financial sector: where both could apply, DORA's requirements take precedence for financial entities, while NIS2 governs other critical sectors. Groups spanning both worlds need one capability mapped to two regimes; see our NIS2 service.
Does DORA cover our cloud and software providers?+
Yes, that is pillar four. You must maintain a register of ICT third party arrangements, embed mandatory contractual provisions, assess concentration risk, and hold monitoring and exit strategies for critical providers, who may themselves fall under direct oversight.
We are compliant on paper. What do supervisors actually test?+
Whether the framework operates: incident classification on real events, evidence of tested continuity and recovery, testing findings remediated on schedule, and management body engagement. Our exercising and audit services build exactly that evidence.
Verwandte Dienstleistungen
NIS2-Konformität
Von der Festlegung des Anwendungsbereichs bis hin zu den Maßnahmen nach Artikel 21 und der 24-Stunden-Meldebereitschaft gemäß Richtlinie (EU) 2022/2555.
Lieferkettensicherheit
Das Risiko, das Sie von Lieferanten und gemeinsam genutzten Plattformen übernehmen: erfasst, zugesichert, vertraglich festgelegt und ausgeübt, gemäß ISO 28000, NIS2 und DORA.
Cyberresilienz
Über die Prävention hinaus: die Fähigkeit, Widerstand zu leisten, zu reagieren und sich zu erholen, während die grundlegenden Dienstleistungen weiterlaufen.
Informationssicherheit
Vertraulichkeit, Integrität und Verfügbarkeit werden durch ein lebendiges ISMS geschützt, das auf ISO 27001 ausgerichtet ist.
Geschäftskontinuitätsmanagement
BIA, ISO 22301-konforme Strategie, Pläne und Validierung: ein Kontinuitätsprogramm, das so konzipiert ist, dass es auch bei einer echten Störung bestehen kann.
Übungen zur Geschäftskontinuität
Planspiele, Funktionsübungen, Cyber-Übungen und Großübungen, die die Pläne und Nachweise gemäß ISO 22301, NIS2 und DORA belegen.
Krisenmanagement
Doktrin, Strukturen und Kommunikationsmaßnahmen, die den Höhepunkt eindämmen und die Erholung verkürzen, verankert in ISO 22361.
Risikomanagement
Vom Risikouniversum zum kontrollierten Risiko: Identifizierung, stressbewusste Bewertung, eigenverantwortliche Behandlung und Live-Überwachung.
Organisatorische Resilienz
Die Struktur über den Plänen: Risiko, Kontinuität, Krise, Cyber und Personal auf einer gemeinsamen Grundlage gemäß ISO 22316.
7A Risikomanagement-Rahmenwerk
Unser firmeneigenes, entscheidungsorientiertes Betriebsmodell: Exposition und Entscheidungssicherheit werden für den Vorstand separat gemessen.
KI-Governance und Resilienz
Governance ist in jede Ebene intelligenter Systeme integriert, vom Modellverhalten bis zur Rechenschaftspflicht des Vorstands und der ISO 42001.
DAEDALUS Flughafen-Resilienz-Rahmenwerk
Das Airport Resilience Framework: fünf Domänen als ein Betriebsmodell für den gesamten Flugplatz, angetrieben vom 7A-Motor, in den Editionen für kommerzielle Luftfahrt, Fracht- und Geschäftsluftfahrt.
Be ready for the supervisor's second question.
Ask us for a DORA gap assessment across the five pillars; the first question is whether you comply, the second is whether you can prove it.
Vereinbaren Sie einen Beratungstermin