DORA 2025: Complete Guide for Financial Entities

Chapter 1: DORA Summary

Context and Genesis of the Regulation

The DORA regulation (Digital Operational Resilience Act) responds to a European realization: the financial sector has become totally dependent on digital technology, but its resilience to cyber incidents remains insufficient.

Triggering Events:

• 300% increase in cyberattacks on the financial sector (2019-2023)
• Major incidents: Travelex (2020), CNA Financial (2021)
• Risk concentration on a few cloud providers
• Regulatory fragmentation between Member States

The DORA Timeline

Date	Event
December 2022	Publication in EU Official Journal
January 2023	Entry into force (transition period)
January 2024	Technical standards (RTS/ITS) finalized
January 17, 2025	Application date
April 2025	First reporting to authorities
2025-2027	Designation of critical ICT providers

Planned Sanctions

DORA introduces a significant administrative sanctions regime:

For Financial Entities:

• Up to €10 million or 5% of annual turnover
• Personal sanctions for directors
• Publication of sanctions (name and shaming)
• License withdrawal in the most severe cases

For Critical ICT Providers:

• Daily penalties up to 1% of global turnover
• Temporary ban from providing services
• Audits imposed by authorities

With Domyno: The DORA compliance dashboard allows real-time tracking of your preparation level and identification of non-compliance risks.

---

Chapter 2: Who Is Covered

Targeted Financial Entities (Article 2)

DORA applies to a broad spectrum of financial sector players:

Banking Sector:

• Credit institutions
• Payment institutions
• Electronic money institutions

Markets Sector:

• Investment firms
• Asset management companies (UCITS, AIF)
• Central securities depositories
• Central counterparties

Insurance Sector:

• Insurance and reinsurance undertakings
• Insurance intermediaries

New Players:

• Crypto-asset service providers
• Token issuers
• Crowdfunding platforms

The Proportionality Principle

DORA recognizes that not all entities present the same risk profile. The regulation provides for a proportionate approach:

Proportionality Criteria:

• Size and complexity of the entity
• Nature, scope and complexity of services
• Digital risk profile
• Systemic importance

Practical Application:

Entity Type	Requirements
Large systemic banks	Full application, mandatory TLPT
Medium-sized banks	Standard application
Small institutions	Simplified regime (threshold < 50 employees, < €10M balance sheet)
Micro-entities	Partial exemptions

Third-Party ICT Providers

Major innovation: DORA creates a direct supervisory framework for ICT providers deemed "critical":

Criticality Criteria:

• Systemic importance for the financial sector
• Degree of substitutability
• Number of financial entity clients
• Interconnections with other critical infrastructures

Potentially Affected Providers:

• Cloud hyperscalers (AWS, Azure, GCP)
• Core banking system vendors
• Payment infrastructure providers
• Market data providers

---

Chapter 3: The 5 Pillars of DORA

Pillar 1: Governance and Organization (Articles 5-6)

Key Requirements:

The management body (board of directors, executive board) assumes ultimate responsibility for ICT risk management.

Concrete Obligations:

• Define and approve the digital resilience strategy
• Allocate resources (budget, skills)
• Approve and review policies
• Oversee ICT provider arrangements
• Ensure ongoing director training

Expected Deliverables:

• ICT security policy approved by the board
• Organization chart with clearly assigned responsibilities
• Minutes attesting to oversight
• Director training plan

With Domyno: The Governance module structures policies and automatically generates reports for management bodies.

Pillar 2: ICT Risk Management (Articles 6-16)

The Risk Management Framework Includes:

Risk Identification (Articles 8-9)

• ICT asset inventory (hardware, software, data)
• Dependency and interconnection mapping
• Identification of critical and important functions
• Vulnerability assessment

Protection and Prevention (Articles 9-11)

• Information security policies
• Identity and access management
• Encryption and data protection
• Change and patch management

Detection (Article 10)

• Continuous system monitoring
• Anomaly and suspicious behavior detection
• Security event correlation

Response and Recovery (Articles 11-12)

• ICT business continuity plans
• Response and recovery plans
• Recovery time objectives (RTO/RPO)
• Regular plan testing

Learning and Evolution (Article 13)

• Post-incident analysis
• Threat intelligence
• Continuous framework improvement

With Domyno: The integrated risk analysis automatically generates the ICT risk matrix and associated treatment plans.

Pillar 3: ICT Incident Management (Articles 17-23)

Incident Classification:

DORA establishes harmonized incident classification based on impact:

Criterion	Minor	Major	Critical
Affected clients	< 10%	10-50%	> 50%
Duration	< 2h	2-24h	> 24h
Financial impact	< €100K	€100K-€1M	> €1M
Compromised data	No	Partially	Massively

Notification Obligations:

• Initial notification: within 4 hours (major incidents)
• Intermediate report: within 72 hours
• Final report: within the month following resolution

Notification Content:

• Incident description
• Root cause (if identified)
• Impact on clients and operations
• Remediation measures taken
• Planned corrective actions

Pillar 4: Resilience Testing (Articles 24-27)

Two Levels of Testing:

Basic Testing (mandatory for all)

• Vulnerability testing
• Source code analysis
• Performance testing
• Scenario-based penetration testing

Minimum Frequency: annual

Advanced Testing - TLPT (Threat-Led Penetration Testing)

• Mandatory for systemic entities
• Based on TIBER-EU framework
• Performed by qualified external testers
• Under competent authority supervision

Minimum Frequency: every 3 years

With Domyno: The integrated testing calendar plans and documents all resilience exercises, with automatic generation of compliant reports.

Pillar 5: Third-Party ICT Management (Articles 28-44)

The Provider Register (Article 28):

Every financial entity must maintain a complete register of its ICT provider arrangements.

Mandatory Information:

• Provider identification (LEI if available)
• Nature of services provided
• Supported functions (critical or important)
• Data processing location
• Contract start and end dates
• Termination possibilities

Ongoing Assessment:

• Risk assessment before contracting
• Service level monitoring
• Regular audits (contractual audit rights)
• Tested exit plans

---

Chapter 4: The ICT Provider Register (Article 28)

Register Structure

The register must be structured, documented, and kept up to date at all times.

Section 1: Provider Identification

Field	Description
Legal name	Full corporate name
LEI	Legal Entity Identifier (if applicable)
Country of establishment	Head office
Processing country	Actual data location
Provider type	Intragroup / External

Section 2: Arrangement Description

Field	Description
Contract reference	Unique number
Signature date	DD/MM/YYYY
Duration	Fixed / Indefinite
Annual value	Estimated amount
Scope	Service description

Section 3: Criticality and Risks

Field	Description
Supported function	Critical / Important / Other
Substitutability	High / Medium / Low
Concentration	Degree of dependency
Last audit	Date and result

Update Process

Trigger Events:

• New contract signed
• Substantial modification of an arrangement
• Significant incident at the provider
• Change in function criticality
• Contract end or termination

Review Frequency:

• Continuous updates (event-driven)
• Minimum annual full review
• Reporting to authorities per defined calendar

With Domyno: The Supplier module automatically maintains an Article 28-compliant register, with alerts on deadlines and necessary revisions.

---

Chapter 5: Resilience Testing

The TIBER-EU Framework

Threat Intelligence-Based Ethical Red Teaming (TIBER) is the European framework for advanced penetration testing in the financial sector.

Key Principles:

• Based on real threat intelligence
• Simulates sophisticated attackers (APT)
• Tests people, processes, and technologies
• Performed by qualified external teams

The 3 TLPT Phases:

Phase 1: Preparation

• Scope definition
• Team briefing (need-to-know)
• Provider selection (Threat Intelligence + Red Team)

Phase 2: Execution

• Reconnaissance and intelligence (6-12 weeks)
• Simulated attack (2-3 months)
• Attempted compromise of critical assets

Phase 3: Closure

• Detailed vulnerability report
• Remediation plan
• Attestation for authority

Annual Testing Program

Mandatory Tests for All Entities:

Test Type	Frequency	Scope
Vulnerability scan	Quarterly	Complete infrastructure
Penetration test	Annual	Critical systems
Continuity test	Annual	Continuity plans
Crisis exercise	Annual	Major cyber scenario

Recommended Test Scenarios

Scenario 1: Targeted Ransomware

• Ransomware infection simulation
• Detection capability testing
• Backup restoration testing
• Crisis communication testing

Scenario 2: Provider Compromise

• Attack simulation via a third party
• Isolation mechanism testing
• Exit plan testing
• Continuity testing without the provider

Scenario 3: Cloud Unavailability

• Major cloud provider outage simulation
• Failover testing
• Actual RTO/RPO measurement
• Degraded mode testing

---

Chapter 6: 12-Month Roadmap

Months 1-3: Assessment and Governance

Month 1: Inventory

• ICT asset inventory
• Existing provider mapping
• Initial maturity assessment
• DORA gap identification

Month 2: Governance

• Define roles and responsibilities
• Create DORA steering committee
• Board presentation
• Budget allocation

Month 3: Foundational Policies

• ICT risk management policy
• Information security policy
• Business continuity policy
• Third-party management policy

Months 4-6: Risk Management Framework

Month 4: Identification

• Critical function identification
• ICT dependency analysis
• Inherent risk assessment
• Threat scenario mapping

Month 5: Protection

• Security control review
• Priority measure reinforcement
• Procedure updates
• Team training

Month 6: Detection and Response

• Detection capability reinforcement
• Incident response plan update
• Classification threshold definition
• Notification procedure testing

Months 7-9: Third-Party Management

Month 7: Provider Register

• Article 28 register constitution
• Contractual information collection
• Criticality/substitutability classification
• Risk concentration identification

Month 8: Provider Assessment

• Assessment methodology definition
• Critical provider evaluation
• Third-party risk treatment plans
• Contractual clause negotiation

Month 9: Exit Plans

• Exit scenario identification
• Exit plan drafting
• Substitutability testing
• Procedure documentation

Months 10-12: Testing and Continuous Improvement

Month 10: Testing Program

• Annual test planning
• Vulnerability scan execution
• Annual penetration test
• Continuity exercise

Month 11: Remediation

• Identified vulnerability treatment
• Documentation update
• Additional training
• Control adjustment

Month 12: Review and Reporting

• Annual risk management framework review
• Regulatory reporting preparation
• Provider register update
• Board presentation

---

Conclusion: DORA as an Opportunity

DORA certainly represents a significant regulatory burden, but it's also an opportunity to sustainably strengthen your organization's resilience.

The 3 Strategic Benefits:

1. Reduced fragmentation - One framework replaces multiple national requirements
2. Competitive advantage - Demonstrated resilience builds customer trust
3. Improved risk management - Better understanding of digital dependencies

The Bridge to US Standards

For US-based financial entities operating in Europe, DORA creates important connections:

• SOC 2 Type II provides a strong foundation for DORA controls
• SEC Cybersecurity Rules complement DORA incident reporting
• FFIEC guidelines align with DORA ICT risk management

Next Step

Discover how Domyno can accelerate your DORA compliance journey. Our dedicated financial sector modules automate provider registry management, risk assessment, and testing documentation.

Request a personalized demo →