DORA requirements explained: video brief

No. The Regulation contains no certification of compliance, no seal and no accredited scheme. Your competent authority supervises through reporting, requests and inspections; ICT providers are judged by their clients and, if designated critical, overseen by the ESAs. A "DORA certificate" is its issuer's own badge; ISO/IEC 27001 and ISO 22301 certificates support the evidence but certify nothing under DORA.

No, though it is a strong start. The ICT risk management technical standard requires security policies based on leading practices and, where applicable, standards (a definition covering ISO and IEC standards), and a certified ISMS or BCMS already holds inventories, risk assessments, controls and exercise records. It does not produce what is specific to DORA: the register templates, classification and reporting to your authority, DORA's testing programme and TLPT, the Article 30 contract terms and the board's ultimate responsibility for ICT risk.

Not directly, unless the ESAs designate you as critical; it reaches you through your clients. Article 30 requires written terms on services, data locations, security, access to and return of data, service levels, incident assistance, cooperation with authorities, termination and training, and, for critical or important functions, contingency plans, participation in threat-led testing, unrestricted rights of access, inspection and audit, and exit support. A critical provider established outside the EU needs an EU subsidiary within 12 months of designation for financial entities to keep using it.

Every financial entity keeps a register of all its ICT contractual arrangements, not only the critical ones, at entity level and, in groups, at sub-consolidated and consolidated level, on the templates of Implementing Regulation (EU) 2024/2956. It reports at least yearly on new arrangements, provides the full register on request and tells the authority in good time about planned arrangements for critical or important functions. In 2025 competent authorities had to pass the registers to the ESAs by 30 April, data that fed the first designation of critical providers.

Classify it against Article 18 and the thresholds of Delegated Regulation (EU) 2024/1772. If it is major, Delegated Regulation (EU) 2025/301 sets the clocks: the initial notification within four hours of classification and no later than 24 hours after becoming aware of it, an intermediate report within 72 hours of the initial notification, and a final report within one month of the latest intermediate report, using the templates of Implementing Regulation (EU) 2025/302. Affected clients are told without undue delay. Reporting can be outsourced; responsibility cannot.