Guide
DORA Guide: Scope, ICT Risk, Incidents, Testing and Third Parties
DORA (Regulation (EU) 2022/2554) has applied to banks, insurers, investment firms, payment and crypto firms and other financial entities since 17 January 2025. It rests on five pillars: ICT risk management, incident reporting, resilience testing, third-party risk and information sharing.
At a glance
| Legal form | Regulation: applies directly in every member state since 17 January 2025 |
| Who | 20 types of financial entity (Art. 2(1)(a) to (t)); ICT providers through contracts, and directly if designated critical |
| Incidents | Initial notification within 4 hours of classifying an incident as major, at the latest 24 hours after becoming aware |
| Third parties | Register of information, Article 30 contract clauses, exit strategies for critical or important functions |
| Lighter rules | Simplified framework for certain small entities (Art. 16); proportionality for all (Art. 4) |
Each point is explained, with its legal source, in the guides below.
Start here
Does DORA Apply to My Firm? Entity Types, Exclusions and Lighter Rules
The 20 types of financial entity in Article 2, what DORA means for ICT providers, the exclusions in Article 2(3), microenterprises and the simplified ICT risk management framework.
9 min read
DORA Compliance Checklist: 59 Requirements by Article (Free Template, 2026)
Every core DORA requirement with its article reference and microenterprise exemptions, as a checklist you can tick off and print, plus a practical roadmap for smaller financial firms.
16 min read
ICT risk management
Incidents
Third-party risk
DORA Register of Information: What to Include, Template by Template
The 15 templates of Implementing Regulation (EU) 2024/2956, the fields that take the most work, the yearly reporting cycle and a practical order for building the register.
12 min read
DORA Contract Requirements: Article 30 Clause Checklist for ICT Providers
Every clause Article 30 requires, the extras for critical or important functions, the termination rights of Article 28(7), and the 2025 subcontracting rules.
11 min read
DORA Exit Strategies and Exit Plans: Article 28(8) Explained
Exit strategies under Article 28(8), exit plans under Delegated Regulation 2024/1773, the transition period of Article 30(3)(f), and how to write a plan you could actually run.
8 min read
Selling Software to Banks and Insurers: What DORA Means for ICT Providers
Why DORA reaches you through your financial customers, the clauses you will be asked to sign, what changes when you support a critical or important function, subcontracting, register data, and when direct oversight applies.
9 min read
Testing
Specific situations
Related articles
Backup and Recovery Requirements Under NIS2 and DORA
Backup plans, storage away from the main network, access control, integrity checks, restore testing, recovery objectives and redundancy, side by side for NIS2 and DORA.
8 min read
Security Awareness Training: What NIS2 and DORA Expect
Awareness for everyone, role-based training for technical staff, board training, suppliers, and how to show it works, under NIS2, Implementing Regulation 2024/2690 and DORA.
8 min read
EU Data Act Cloud Switching Rules: What SaaS and Cloud Providers Must Offer
Who counts as a data processing service, the clauses every cloud and SaaS contract now needs, the switching timeline, the end of switching charges on 12 January 2027, and what customers should ask for.
10 min read
Free tools
DORA Compliance Checker
Free assessment across all 5 DORA pillars.
Vendor Risk Assessment
Assess your ICT third-party providers.
Templates
DORA Compliance Checklist for Financial Firms · $34.00
Gap-assessment workbook, ICT risk framework template, incident classification matrix, provider register.
Get the templates →Vendor Security Assessment Pack · $39.00
DORA Article 30 clause addendum, exit plan template, security questionnaire.
Get the templates →Other guides: NIS2 · GDPR · Cyber Resilience Act · AI Act and AI agents · Security for startups and SMEs
This guide is for informational purposes only and does not constitute legal advice. Last updated: October 2026.