DORA has applied across the EU since January 17th, 2025, and supervisors now cross-reference Registers of Information to spot gaps and inconsistencies. DORA compliance is no longer extra preparation; it’s an enforceable requirement with real consequences.
DORA, or Regulation (EU) 2022/2554 is the European Union’s effort to create a unified framework for financial entities in the EU to manage information and communication technology risk. Supervision runs through national competent authorities and the three European Supervisory Authorities (ESAs): the European Banking Authority (EBA), the European Insurance and Occupational Pensions Authority (EIOPA), and the European Securities and Markets Authority (ESMA).
Each year, national regulators forward firms’ Registers of Information to the ESAs, which can cross-reference them automatically. RoI responses compiled across the EU have subsequently formed the basis of Critical Third Party Provider designations, which has extended the reach of European Supervisory Authorities to technology service providers for the first time.
Fully enforced on January 17th, 2025, DORA applies to a purposefully large institutional population.Banks, insurers, investment firms, payment and electronic money institutions, crypto-asset service providers, trading venues, credit rating agencies, plus the ICT third-party providers who serve them all fall under this all fall within scope of the act. Whereas previous guidance may have treated technology risk simply as one operational risk among many, DORA treats digital resilience as its own discipline, with its own reporting, testing and contractual obligations.
DORA is structured around five pillars. Here’s each pillar, as well as more information about what they require:
(Articles 5–16)
Requirements: A governance and control framework for ICT risk, owned by the management body. Identify ICT-supported business functions, map the assets and dependencies behind them, and maintain protection, detection, response and recovery capability.
(Articles 17–23)
Requirements: Classify ICT-related incidents against defined criteria and report major incidents to the corresponding authority within set deadlines, through initial, intermediate and final reports.
(Articles 24–27)
Requirements: Test resilience regularly, proportionate to size and risk profile. Designated entities must also conduct threat-led penetration testing at least every three years.
(Articles 28–44)
Requirements: Maintain a Register of Information covering all contractual arrangements with ICT providers, meet mandatory contractual requirements, assess concentration risk, and hold documented exit strategies.
(Article 45)
Requirements: Voluntary arrangements for exchanging cyber threat intelligence among financial entities.
Enterprise resilience, or comprehensive preparation in the face of a disruption, is a decision challenge. Most large organizations cannot answer the four most important questions that must be answered at decision speed when disruption hits:
DORA only compounds this problem. The challenge lies in building datasets and maintaining them, which requires a strategic technology solution that can address all three use cases while maintaining consistency between them, highlighting gaps for resolution, while making the data and plans actionable, not just reportable. This is because your organization’s data has to meet multiple requirements. Your organization must be prepared to present data that meets the requirements of a Register of Information for the supervisor, an incident classification against regulatory thresholds, a concentration-risk assessment for the board, and a tested exit plan for each critical provider. Entities that hold these formats in separate systems produce answers that will naturally contradict each other.
Fusion is purpose-built to prepare your organization for compliance and ICT resilience, in all formats, in one system, by answering the above questions.
| REGULATORY REQUIREMENT | HOW FUSION MEETS DORA REGULATORY REQUIREMENTS |
|---|---|
| Identify ICT-supported critical or important functions | Model business functions and trace each to its full dependency chain, so the same definitions support pillar one mapping, register classification, and incident scoping. Fusion helps your organization map ICT assets and dependencies to the CIF. |
| Maintain the Register of Information | Hold ICT provider arrangements inside the dependency model rather than in a separate spreadsheet, including third-party chains and the linkage between provider, contract, service and supported function. |
| Assess ICT concentration risk | Surface where multiple important functions converge on a single provider or designated CTPP, including fourth-party and intragroup exposure. |
| Classify and report ICT-related incidents | Trace a disruption signal to the affected functions at decision speed, so classification against regulatory thresholds and the initial, intermediate and final reporting sequence rest on an accurate assessment. |
| Conduct resilience testing | Scenario testing alone won’t be defensible to regulators; they will expect evidence of substantive testing and exercising. Disruption modelling through simulations should be a first step to building a perspective on where risk lies and how to uncover blind spots (ex:, previously unidentified severe impacts or missing response & recovery plans). This is then followed by substantive testing and exercising which is orchestrated and evidenced in Fusion. |
| Evidence recovery and exit planning | Recovery Optimization sequences recovery against function criticality and dependency order, producing a prioritized plan of attack, retained in Fusion, for supervisors, board members and execution during real disruption |
Watch this webinar replay to hear why your third-party vendors are critical in ensuring compliance with DORA.
WATCH NOW
Watch this webinar replay to learn how to comply with DORA’s requirements.
WATCH NOW
Watch this webinar replay to learn more about the Digital Operational Resilience Act (DORA) regulations and their implications for your firm.
WATCH NOWDORA does not apply directly to UK-only firms. It does reach UK organizations with EU-authorised entities or branches, and UK ICT providers serving EU financial entities, who may be brought within the oversight framework. Separately, the UK operates its own Critical Third Parties regime under the Bank of England, PRA and FCA, in force since January 1st, 2025 with the first designations announced in July 2026. The two regimes are designed to be compatible, and the ESAs and UK regulators signed a memorandum of understanding in January 2026 to coordinate oversight.
DORA applies to a broad range of EU financial entities including credit institutions, payment and electronic money institutions, investment firms, crypto-asset service providers, insurers and reinsurers, trading venues, central securities depositories, credit rating agencies and crowdfunding service providers. It also applies to ICT third-party service providers serving them, and brings designated Critical ICT Third-Party Providers under direct supervision by the European Supervisory Authorities.
The Register of Information is the structured record, required by Article 28, of every contractual arrangement a financial entity holds with an ICT third-party provider. It is maintained at entity, sub-consolidated and consolidated level and submitted through the national competent authority, which consolidates and passes registers to the European Supervisory Authorities by March 31st each year. It is the primary data source used to designate Critical ICT Third-Party Providers and to map concentration risk across the EU financial system.
Threat-led penetration testing (TLPT) is an advanced form of resilience testing that simulates the tactics of real threat actors against live production systems. Under Article 26, financial entities identified as significant must carry out TLPT at least every three years, covering critical or important functions and including the ICT providers that support them.
DORA is a single binding regulation applying uniformly across the European Union. Asia-Pacific has no equivalent instrument: each market sets its own expectations, ranging from a binding prudential standard in Australia under APRA CPS 230 to supervisory guidelines in Singapore and Japan. The underlying disciplines are closely aligned; critical services, tolerances, dependency mapping and scenario testing, but the deadlines, definitions and reporting formats differ by jurisdiction. See the APAC operational resilience regulations page for a market-by-market comparison.