The EU’s Digital Operational Resilience Act (DORA) regulation came into full effect on January 17, 2025, two years after its adoption. Its primary goal is to enhance the financial sector’s resilience against digital risks like cyber threats and technology failures.
DORA provides a comprehensive framework requiring financial institutions to implement strong operational resilience measures, ensuring they are well-prepared to handle ICT (Information and Communications Technology) disruptions. Key aspects of the regulation include Risk Management, Incident Reporting, Testing and Audit, and Third-Party Risk Management.
So, what does this mean for businesses, and what should they focus on?
Tiernan Connolly, MD of Cyber and Data Resilience at Kroll, explains that DORA requires organizations to identify their critical business processes and link them to the technology assets and third parties that support them. This helps businesses spot critical dependencies and risks, set up real-time monitoring, and regularly test these connections. He also points out that DORA will increase transparency in incident reporting, standardize testing methods like red teaming, and tighten third-party risk management protocols, pushing businesses to adopt proactive resilience strategies. This, in turn, will reduce long-term risks and improve overall digital resilience.
Looking ahead, Connolly notes that the upcoming EU Cyber Resilience Act, set for full implementation by 2027, will focus on building robust security measures into the development and post-sale processes of digital products. This will complement DORA by holding vendors accountable for securing the products used by enterprises.
Joe Vaccaro, head of Cisco ThousandEyes, highlights DORA’s expansion to include the ICT suppliers financial services firms rely on to deliver services. In today’s interconnected world, businesses can’t simply reboot the Internet, so they need to manage disruptions more effectively. Vaccaro stresses the importance of understanding hidden dependencies, like third-party services and their cloud providers, to ensure continued service delivery.
For financial services, he notes the need to identify and map third-party dependencies and establish ongoing processes to monitor those connections. This focus on digital resilience applies to all industries, not just finance, and should be addressed at the boardroom level.
Andre Troskie, EMEA field CISO at Veeam, advises that businesses ensure their third-party partners have strong risk management processes. He also recommends renegotiating service level agreements (SLAs) with third-party providers to ensure compliance with DORA’s requirements.
Richard Lindsay, principal advisory consultant at Orange Cyberdefense, points out that non-compliance could lead to severe consequences, including fines of up to 1% of global daily turnover and over €1 million for individual senior leaders. These penalties can emphasize the importance of cybersecurity and compliance to the board. Lindsay further suggests that most compliance requirements can be met by investing in cyber risk assessments, incident reporting, resilience testing, and governance across frameworks.
Desre Sheen, head of UK Financial Services Consulting Practice at Capgemini, says that while financial institutions are meeting DORA’s minimum compliance requirements, the real challenge lies in maintaining and evolving a resilience culture. Plans must remain flexible as critical business services may change over time, and not every firm will interpret regulations the same way.
John Smith, Veracode EMEA CTO, emphasizes the need for a comprehensive digital resilience testing program that includes various methodologies to assess security and resilience. Regular vulnerability scans, open-source risk analysis, and threat-led penetration testing are all critical components for meeting DORA’s requirements. He also stresses the importance of training staff at all levels in ICT security awareness, secure coding practices, and operational resilience.
Tim Wright, partner and technology lawyer at Fladgate, acknowledges that smaller firms face challenges due to resource limitations and the complexity of DORA’s 500+ requirements. He suggests that firms struggling to meet full compliance should demonstrate good faith efforts and maintain communication with regulators, as authorities are likely to focus enforcement on major breaches. Despite the initial implementation costs, Wright believes that long-term benefits like enhanced resilience and better risk management will outweigh the costs. DORA is also expected to create a surge in demand for cybersecurity professionals, offering career opportunities in the financial sector.
Bob Wambach, VP of Product Portfolio at Dynatrace, warns that compliance alone isn’t enough for financial services firms. To be truly prepared, organizations need to go beyond meeting the minimum requirements of DORA and focus on creating a culture of resilience. This includes continuous testing, real-time anomaly detection, and prioritizing the ability to respond to disruptions quickly.
Andrew Rose, CSO at SoSafe, notes that many financial services and ICT organizations have already developed the cyber maturity required to comply with DORA. However, for previously unregulated sectors, such as crypto exchanges and peer-to-peer lending platforms, DORA introduces a new level of control requirements. Rose emphasizes that DORA’s controls are necessary and timely, especially after significant losses in the crypto industry. He also highlights that most cyber breaches result from human error, and a strong compliance effort must be paired with training and awareness programs to truly protect against future risks.
In conclusion, while DORA represents a significant shift in the regulatory landscape for the financial sector, it also presents a broader opportunity for businesses to build more resilient, secure systems capable of withstanding digital disruptions. Compliance is just the first step; continuous effort, proactive testing, and a strong culture of resilience are essential for long-term success.
