Regulation (EU) 2022/2554
DORA
A regulation for financial entities that lands on their suppliers. Twenty kinds of financial entity must manage ICT risk, report incidents, test resilience and keep a register of every ICT provider, with contract clauses the provider has to accept. If you sell software to a bank, an insurer or a payment company, those clauses are coming to you.
Does it apply to you?
Directly for finance. Through contract for anyone finance depends on.
In scope
You are a financial entity.
Payment institutions, e-money institutions, crypto-asset service providers, investment firms, insurers, credit institutions and the rest of the twenty types listed in Article 2. The whole regulation applies.
In scope, through contract
You provide ICT services to a financial entity.
Articles 28 to 30 make your customer put you in its register of information and write the clauses into your contract: audit rights, sub-outsourcing, data locations, exit. Critical providers come under direct oversight.
Out of scope
Neither.
No financial entity among your customers, no financial licence of your own: the regulation does not reach you. Its register is still the best model for your own vendor list.
What the regulation asks
Articles 5 to 16
An ICT risk management framework
Identification, protection, detection, response and recovery, learning, and communication, owned by the management body and reviewed every year.
Articles 17 to 23
Incident management and reporting
Classify ICT incidents by the thresholds in the technical standard; report major ones to the competent authority with an initial notification, an intermediate report and a final report.
Articles 24 to 27
Resilience testing
A testing programme every year, and threat-led penetration testing every three years for the entities designated for it.
Articles 28 to 30
Third-party risk and the register
A register of information covering every ICT provider, a preliminary assessment before contracting, mandatory contract clauses, concentration risk, and exit strategies.
When it applies
In force and applying, with the technical standards that fill in its details adopted alongside it. Read the regulation.
- 16 January 2023Entered into force, twenty days after publication in the Official Journal.
- 17 January 2025Applies. Financial entities and their ICT providers must meet it from this date.
- 2024 and 2025The technical standards on incident classification, the register of information, critical provider designation and oversight were adopted; the catalog carries them as separate entries.
How the evidence lands
The register of information
Every ICT provider with its sub-processors, data processing locations and reports, from the vendor graph. The register Article 28 asks a financial entity to keep, and the one a provider must be able to answer.
Incidents with a timeline
An incident register with classification and the dates of each notification, as the evidence of Articles 17 to 23.
Availability and backups
Backup state and service availability read from your clouds, as evidence for the recovery part of the framework.
Access and change
Who can reach production and what changed, from your source control and identity tools, for the protection and detection functions.
See the register of information build itself
Thirty minutes. We connect one of your integrations live and show the first readings landing on your controls.