DORA · Digital Operational Resilience Act · Regulation (EU) 2022/2554
DORA compliance consulting for ICT resilience your supervisor can test and your board can stand behind.
Meet the Digital Operational Resilience Act with a programme your competent authority can examine: an ICT risk management framework the board owns, incidents reported within the deadlines, testing that finds weaknesses first and a register of information that matches your contracts. Sterling's expert and experienced consultants work alongside your ICT, risk, procurement and legal teams, build the evidence and stay involved after go-live, in 60+ countries. We ensure a successful DORA compliance programme for our clients.
- Fixed scope, one proposal: consulting, Effivity software, Sterling Academy access and internal auditor training, as applicable to your standard, in one proposal
- A team of expert and experienced operational resilience consultants, advising on management systems across sectors and countries since 2003
- The Sterling Promise: 100% on-time completion, 100% success, 8,100+ client engagements. Sterling builds the framework, the register and the evidence; compliance is supervised by your competent authority
8,100+ client engagements in 60+ countries.
DORA client experience
What it is
What is DORA and what is it used for?
The Digital Operational Resilience Act, Regulation (EU) 2022/2554, is the EU law on ICT risk in finance. Directly applicable in every Member State, it gives twenty types of financial entity one harmonised rulebook so that, in the words of EIOPA, one of the European supervisors, they can withstand, respond to and recover from ICT disruptions such as cyberattacks or system failures. Its obligations fall into five areas, often called its pillars: ICT risk management (Chapter II); ICT-related incident management, classification and reporting (Chapter III); digital operational resilience testing (Chapter IV); ICT third-party risk (Chapter V); and information sharing (Chapter VI). Chapter V also sets up the Oversight Framework through which the European Supervisory Authorities (EBA, EIOPA and ESMA) oversee ICT providers designated as critical.
DORA is supervised, not certified. The Regulation contains no certification of compliance: your competent authority (usually the national supervisor; the ECB for significant banks) can require any document, inspect on site and order remedial measures, and each Member State sets the administrative penalties. Article 4 scales the rules to size, overall risk profile and the nature, scale and complexity of what you do, and Article 16 gives certain smaller entities a simplified framework. Proportionality never removes the need to show, with records, that the arrangements operate.
Current text. Regulation (EU) 2022/2554 of 14 December 2022, published in the Official Journal on 27 December 2022, has applied since 17 January 2025. Commission technical standards in force supply the detail: RTS on ICT risk management and the simplified framework (Delegated Regulation (EU) 2024/1774), incident classification (2024/1772) and the ICT third-party policy (2024/1773); ITS on register of information templates (Implementing Regulation (EU) 2024/2956); RTS and ITS on major-incident reporting (2025/301 and 2025/302); RTS on threat-led penetration testing (2025/1190) and subcontracting (2025/532). On 18 November 2025 the ESAs published the first list of designated critical ICT third-party providers, 19 in all; it is updated yearly. The programme follows the texts in force and your authority's guidance.
Who it is for
Who needs to comply with DORA?
Article 2 lists twenty types of financial entity, from credit, payment and e-money institutions, investment firms and crypto-asset service providers to insurers, insurance intermediaries, occupational pension institutions, fund managers, market infrastructures and credit rating agencies. A few are excluded, such as insurance intermediaries that are micro, small or medium-sized enterprises. ICT third-party service providers are in scope for the Oversight Framework, and every ICT provider meets DORA through its clients' contracts. Most DORA enquiries start from one of four positions:
- You are a financial entity and parts of the programme are still a project. DORA has applied since January 2025, and supervisors expect the register, incident classification, testing and board oversight to run as routine. Policies without operating records show at the first supervisory request.
- You provide ICT services to EU financial entities. Software houses, cloud and data-centre operators, managed service providers and BPOs in the Philippines, India, the UAE and elsewhere are asked to sign the terms Article 30 requires, from audit rights to exit support, and Article 28(5) lets clients use only providers meeting appropriate information security standards.
- Your group has an EU-licensed entity. A bank, insurer, payment or investment group based in the Gulf, Asia or elsewhere needs its EU entity's framework, incident process and register to work, often on group systems, with the register kept at entity, sub-consolidated and consolidated level.
- You hold ISO/IEC 27001 or ISO 22301 and assumed it covered DORA. The certificates help, but produce no register in the prescribed templates, no classification against regulatory thresholds, no reporting to your authority within hours and no Article 30 contract terms.
Business benefits
How DORA compliance strengthens resilience and supervisory confidence
DORA pays back where ICT failure meets money and trust: a payments outage at month end, ransomware at a provider, a contract that cannot be exited. The programme begins with those moments and gives each an owner, a procedure and a record.
- A register you can submit without a scrambleEvery ICT contract, provider, function and subcontractor in the prescribed templates, reconciled with procurement and finance: the yearly collection becomes an export.
- Incidents handled on the regulatory clockA classification matrix built from the seven criteria, a decision owner on call and templates ready for the authority.
- Contracts that already carry the termsService levels, data locations, audit rights, incident assistance, exit plans and subcontracting conditions agreed at renewal, not in a crisis.
- Weaknesses found by you firstRisk-based testing from vulnerability scans to penetration tests, findings closed, and continuity and recovery plans tested every year.
- A board that can evidence its oversightApprovals, budget, risk tolerance and the management body's own training on record: the oversight Article 5 expects.
- One control set for several regimesThe same inventory, risk method, incident process and supplier controls serving DORA, ISO/IEC 27001, ISO 22301 and client audits.
Measure it by what it proves: incidents classified on time, contracts carrying the Article 30 terms, critical-function tests done and findings closed, register entries reconciled. A count of approved policies proves nothing.
Requirements
What are the main DORA requirements?
The Regulation has 64 articles in nine chapters; the duties of financial entities sit in Chapters II to VI, detailed by the Commission's technical standards. The table maps them to practice. The programme checks your arrangements against the texts in force, article by article; legal interpretation goes to your legal advisers.
| Article | What it requires of you | What it looks like in practice |
|---|---|---|
| Art. 5 Governance and organisation | Internal governance and control of ICT risk; the management body defines, approves, oversees and answers for the framework, bears ultimate responsibility for ICT risk, approves the digital operational resilience strategy, allocates budget and keeps its knowledge current through regular training | Minutes approving the framework and strategy, a named owner of ICT risk, budget decisions and board training records |
| Art. 6 to 16 ICT risk management framework | A sound, comprehensive and well-documented framework within overall risk management, reviewed at least yearly (periodically for microenterprises) and after major incidents, and internally audited except in microenterprises; covering identification, protection and prevention, detection, response and recovery, backup and restoration to recovery time and point objectives, learning and evolving, and communication. Entities listed in Article 16 apply a simplified framework instead of Articles 5 to 15, detailed in Delegated Regulation (EU) 2024/1774 | An inventory of ICT-supported functions, assets and dependencies; access, change, patch and encryption policies; an ICT business continuity policy with response and recovery plans tested at least yearly; restore tests; post-incident reviews |
| Art. 17 to 23 ICT-related incident management, classification and reporting | Detect, record, manage and escalate ICT-related incidents; classify them against the criteria and thresholds of Delegated Regulation (EU) 2024/1772; report major incidents to the competent authority (initial notification, intermediate report, final report); inform affected clients without undue delay; notify significant cyber threats voluntarily | An incident register with each classification recorded, root causes analysed, the templates of Implementing Regulation (EU) 2025/302 ready and the reporting clocks in the workflow |
| Art. 24 to 27 Digital operational resilience testing | Except for microenterprises, a risk-based testing programme by independent internal or external testers, testing every ICT system and application supporting critical or important functions at least yearly; if your authority identifies you, threat-led penetration testing (TLPT) at least every three years on live production systems, under Delegated Regulation (EU) 2025/1190 | A yearly test plan tied to the inventory, findings closed and, for identified entities, a scoped TLPT and its attestation |
| Art. 28 to 30 ICT third-party risk | Full responsibility for outsourced ICT; a strategy on ICT third-party risk (not for Article 16 entities or microenterprises) with a policy for services supporting critical or important functions (Delegated Regulation (EU) 2024/1773); a register of information on all ICT contractual arrangements at entity, sub-consolidated and consolidated level; concentration risk assessed; providers meeting appropriate information security standards, on written terms with exit strategies and subcontracting conditions (Delegated Regulation (EU) 2025/532) | A register on the templates of Implementing Regulation (EU) 2024/2956 reconciled with procurement and finance, due-diligence files, a contract remediation plan and exit plans for critical services |
| Art. 31 to 44 Oversight of critical ICT third-party service providers | The ESAs designate critical providers on systemic impact, the importance of the entities relying on them, reliance for critical or important functions and substitutability, and a Lead Overseer oversees each; a designated provider established outside the EU needs an EU subsidiary within 12 months of designation for financial entities to keep using it | Designated providers flagged in the register and oversight outcomes read into risk assessments; providers ready for the Lead Overseer's examinations |
| Art. 45 Information-sharing arrangements | Optional exchange of cyber threat information and intelligence, such as indicators of compromise, within trusted communities of financial entities, with the competent authority notified on joining and on leaving | A recorded membership decision, sharing rules protecting confidential and personal data, and both notifications filed |
What does useful DORA evidence look like?
Board minutes approving the framework and strategy, and training records; the inventory of functions, assets and dependencies; the yearly framework review and the internal audit that tested it; an incident register showing every classification, including incidents judged not major; reports sent to the authority; test results with fixes; continuity and recovery test reports; the reconciled register; contracts with the Article 30 terms and exit plans. All of it is built from your operations and held in Effivity from the first workshop.
DORA requirements explained, article by articleCompliance process
How do you become DORA compliant?
Build the arrangements, run them, then show them. Sterling designs the programme and builds it alongside your teams; your competent authority supervises it and, for an ICT provider, clients audit it.
- 01Settle the scope: entities, functions and authorities.Confirm entities and group levels, competent authorities, whether simplified-framework or microenterprise rules apply, your critical or important functions and, for a provider, which client obligations reach you.
- 02Gap analysis: measure today's arrangements against the Regulation and its technical standards.The gap analysis tests governance, the framework, incidents, testing, third parties and information sharing against Articles 5 to 45 and the RTS and ITS in force, reuses ISO/IEC 27001 and ISO 22301 evidence, and fixes actions, owners and dates.
- 03Build the framework, the register and the contracts.Write the strategy and policies, complete the inventory, populate and reconcile the register, set up classification and reporting, design the testing programme and remediate contracts, critical or important functions first.
- 04Test, audit and close the findings.Run the first tests and the continuity and recovery exercises, then the internal audit and the management body review; findings surface internally first and each is closed with evidence.
- 05Complete the supervisory or customer review.Answer supervisory requests, submit the register when your authority collects it and produce the framework review report on request; providers answer client audits from an evidence pack that already exists.
- 06Keep the programme running.Yearly reviews and tests, a register that follows contract changes, incidents reported, TLPT every three years where required, and new technical standards absorbed.
Judge a DORA offer by what it produces: who builds the register and reconciles it with your contracts, who writes the classification rules, whether policies are drafted for your functions or copied, what your board and staff will be taught and where records will be kept. A "DORA certificate" sells what the Regulation does not provide. How to choose a credible DORA provider · The certification buyer's checklist
Cost
How much does DORA compliance cost?
A DORA programme is priced by the entities and group levels in scope, the ICT providers and contracts to register and remediate, the critical or important functions and their systems, and the ISO/IEC 27001 or ISO 22301 groundwork in place. A payment institution and a banking group with hundreds of ICT arrangements need different programmes; either way, every component of a Sterling proposal is itemised and nothing is added later.
| Cost component | What affects it |
|---|---|
| Consulting and implementation | Entities, providers and contracts, critical or important functions, the existing ISMS or BCMS, deliverables, and whether your team or ours carries the work (Design™ or Drive™) |
| Independent testing and review | External testers for penetration tests or TLPT and any auditor or assessor you appoint, shown separately |
| Internal resources and legal | ICT, risk, procurement and legal time for the inventory, register and renegotiation, tooling changes, board time, training and any legal review |
| Software and learning | Included in a Sterling engagement: Effivity for the programme and Sterling Academy access for your people, with users, courses and access period confirmed in the proposal |
| Continued support | Framework review each year, register upkeep, test planning, post-incident reviews, regulatory monitoring and refresher learning, all under Sustain™ |
What moves the price
- Entities, group levels and competent authorities in scope
- ICT providers and contracts, and how many support critical or important functions
- Whether an ISMS, a BCMS, an asset inventory or a contract database exists
- Contract remediation outstanding with large providers
- Supervisory findings, client deadlines or a TLPT notification
What a Sterling proposal always shows
- Deliverables, responsibilities, assumptions and exclusions, in writing
- Tester, assessor and legal fees identified separately, so the full programme cost is comparable
- Effivity, training and Academy access itemised at no additional cost
- Payment milestones tied to deliverables, not to the calendar
- One all-inclusive proposal. No surprises, ever
Timeline
How long does DORA compliance take?
Four to nine months is realistic: shorter for a single entity with an ISO/IEC 27001 system, a contract database and a working incident process; longer for a group with many providers and several authorities. The pace is set by reconciling the register, negotiating with providers, agreeing classification rules and running first tests and recovery exercises long enough to leave evidence, each tracked in Effivity.
| Phase | What determines the pace |
|---|---|
| Scope and gap analysis | Access to ICT, risk, procurement and legal owners, contracts and existing records |
| Build and implementation | Register reconciliation, provider negotiations, reporting set-up, approvals and training |
| Testing, evidence and review | First tests and continuity exercises done and findings addressed, then internal audit and board review |
| Regulator or customer review | When your authority collects the register or asks for the review report, any inspection and, for providers, client audit dates |
Because DORA already applies, the plan starts with what a supervisor or an incident would expose first: major-incident reporting, the register and the contracts behind critical or important functions. We say at the outset what can be ready by any date you have been given. Full compliance promised within a month, before anyone has read your contracts, deserves scepticism.
Challenges
Common DORA implementation challenges
DORA programmes tend to stall in the same five places. Each has a workable fix.
The register of information will not reconcile.
Contracts sit with procurement, invoices with finance and systems with IT, each naming providers differently. We build the register from all three, assign the identifiers the templates require, map arrangements to functions and validate before submission.
Contracts with ICT providers lack the Article 30 terms.
Hundreds of agreements cannot be renegotiated at once. We rank them by the functions they support, use renewals and addenda, log remaining gaps as risks with owners, and fix access, audit, exit and testing terms in critical or important arrangements first.
Nobody is sure when an incident becomes major.
A classification matrix turns the technical standard's criteria and thresholds into your services and client numbers, with a decision owner and deputy, templates ready and a rehearsal against the clocks, so classification takes minutes.
ICT risk still belongs to the IT department.
Article 5 places it with the management body. We prepare the approvals, the board's reporting and training, and a control function with appropriate independence, so accountability shows in the minutes.
Testing means one penetration test a year.
DORA expects a programme: vulnerability assessments, network and physical security reviews, scenario, performance, end-to-end and penetration tests, chosen by risk and tied to the inventory, plus yearly continuity and recovery plan tests. We design and schedule it and track findings to closure.
Your engagement
What your DORA engagement includes
The agreed scope covers what a supervised programme needs, from one team for one all-inclusive proposal: analysis, framework, register, contract plan, software, training and a review proving it works.
Scope, gap analysis and implementation plan
Entities, functions, providers and authorities confirmed, every article tested against today's position, and actions, owners and deadlines fixed before the work begins.
Framework, policies and the register of information
Strategy, policies, the inventory, the classification and reporting workflow and the register, on Sterling's template sets, adapted to your operations.
Effivity ISO & GRC software
Your programme runs in Effivity from day one, included with the engagement at no additional cost.
Training for everyone
Internal auditor training for your audit team, as applicable to your standard, and preferential Sterling Academy access, including complimentary awareness training for your people as part of the engagement, with a briefing for the management body on its DORA duties.
Internal audit and management body review
Carried out or facilitated, as agreed, with the independence your internal audit function requires, and findings closed with evidence before your authority asks.
Review readiness and support
Preparation for supervisory requests, register collections and client audits, and support through the first cycle of tests and reports.
Compliance is supervised by your competent authority. Sterling's role is to consult; it does not give legal advice.
How we deliver
How Sterling supports your DORA implementation
Every DORA engagement runs on Sterling OS™, our delivery operating system: five phases with named deliverables, decision owners and evidence at each stage. You decide how much of the work stays with your team; method, software and accountability are constant.
- 01Design™Guided implementation: your ICT risk lead and process owners do the work, coached by Sterling with its templates and workshops.
- 02Drive™Fully managed consulting: Sterling's consultants do the inventory, register, policy and contract work with your ICT, procurement and legal teams.
- 03Sustain™Every year after: framework review, register upkeep, test planning, incident reviews, internal audit and refreshers.
- 04Automate™The programme in Effivity: assets, risks, incidents, tests, providers, contracts, audits and board reporting in one workspace.
- 05Revise™New or amended technical standards, shifting supervisory expectations, changes of scope, and integration with ISO/IEC 27001, ISO 22301 or NIS2.
Week one settles who leads, how often we meet, what is delivered and who decides. Progress is checked against those commitments, so gaps surface early, not when the authority writes.
How Sterling OS™ worksOften combined with
Standards organisations pair with DORA
- ADHICS (Abu Dhabi)ADHICS compliance consulting for DoH-regulated healthcare entities in Abu Dhabi: patient information, systems and devices protected, with audit-ready evidence.
- AML / CFT programme (FATF)AML/CFT compliance programme built on the FATF Recommendations: risk assessment, due diligence, monitoring, reporting, records and training, in one all-inclusive proposal.
- APRA CPS 234 and CPS 230APRA CPS 234 and CPS 230 compliance for banks, insurers and super funds: information security, operational risk, continuity and service providers, all-inclusive proposal.
- Basel and UK operational resilienceOperational resilience compliance for PRA and FCA firms: important business services, impact tolerances, mapping, scenario testing and the Basel principles.
- BSP circulars (Philippines)BSP circulars compliance for Philippine banks and BSFIs: IT risk management, information security, business continuity and outsourcing, in one all-inclusive proposal.
- CBUAE regulationsCBUAE compliance and requirements for licensed institutions: operational risk, cybersecurity, continuity, outsourcing and consumer protection, in practice.
Effivity · DORA programme software, included in every engagement
How Effivity helps you fulfil, automate and simplify the requirements of DORA, Regulation (EU) 2022/2554.
Every Sterling DORA engagement includes Effivity, the ISO and GRC automation platform built by the Sterling group and used in 50+ countries. Your consultant configures the workspace within the agreed scope, so the inventory, ICT risks, classified incidents, tests and findings, continuity plans, providers and contracts, training, audits and board reporting sit in one place, recorded as the work is done. Sterling consulting clients get their Effivity subscription included with the engagement, at no additional cost.
Management body approvals, roles and training
Framework and strategy approvals, the ICT risk owner and control function, budget decisions and board training, each dated and linked to evidence.
Framework, strategy and the yearly review
Policies, the resilience strategy and its risk tolerance, each yearly review and report, and the internal audit that tested them.
Functions, assets and dependencies
ICT-supported functions, information and ICT assets, interdependencies and processes relying on providers, kept current as systems change.
Continuity policy, plans and yearly tests
The ICT business continuity policy, response and recovery plans, recovery objectives per function and test reports with actions, in the business continuity module used for ISO 22301.
Incidents recorded, classified and reported
Each incident logged with its classification against the seven criteria, decision time, root cause and corrective action, with major-incident reports kept together.
The testing programme and its findings
Tests planned against the inventory and critical or important functions, findings remediated and retested, and any TLPT attestation filed.
Providers, contracts and the register data
Due diligence, contract terms, subcontractors, exit plans and concentration notes per provider, with the register data alongside, reconciled rather than rebuilt yearly.
Post-incident reviews, awareness and training
Lessons from incidents and tests acted on, and awareness and resilience training tracked for every employee and board member, linked to Sterling Academy.
What this means at the audit
Internal auditors, authorities and client audit teams ask for the same things: the register, the last framework review, incidents and their classifications, test results and fixes, provider contracts, board training. Effivity holds each as a live record with its date, owner and evidence, and Sustain™ works from the same workspace, so next year's review starts from records.
In your engagement
- Subscription included with the engagement, at no additional cost
- Configured by your Sterling consultant within the agreed scope
- Existing inventories, contract data and registers imported without retyping
- Admin and user training for ICT, risk and procurement teams
- Modules for ISMS, business continuity, PIMS and QMS as you add standards
DORA client experience
Client letters on file, available on request.
Signed client letters for DORA are available on request. The client feedback wall lists every letter by standard.
Programmes with DORA in scope
How DORA fits beside ISO/IEC 27001 and ISO 22301.
- 01Integrated management systems
Financial services and their ICT providers: security, continuity and DORA as one programme
How such a programme typically runs: the ISO/IEC 27001 risk method and controls and the ISO 22301 impact analysis, recovery objectives and exercises form the base; DORA adds board accountability, the register of information, incident classification and reporting to the authority, the testing programme and the contract terms, with one inventory, evidence base and audit calendar for all of it, from which ICT providers also answer their financial-sector clients.
Sterling Academy · DORA e-learning
DORA makes ICT security awareness compulsory. Train everyone, the board included.
Academy courses pair short video lessons with practice checkpoints and end in a final exam; learners who pass get a numbered Certificate of Completion, verifiable online. Sterling consulting clients benefit from preferential course access and special pricing through their Sterling consultant, including complimentary awareness training for their people as part of the engagement.
- DORA awareness for every employee, supporting the compulsory ICT security awareness and resilience training of Article 13
- Practitioner courses for the ICT risk lead, incident handlers, procurement and register owners
- Internal auditor training, as applicable to your standard, for the people who will audit the programme, as part of the engagement
- Learner progress by department, and a training report an authority or client auditor can follow
- New joiners trained on arrival, so records stay complete between reviews
- Questions from learners answered by a Sterling consultant
Keep exploring
Explore more about DORA
Watch a video on how to comply with DORA here.
Watch a video on DORA requirements here.
DORA resources
Why Sterling
Want successful DORA compliance? Come to Sterling.
From a single EU payment institution to a group with entities, authorities and providers in several countries, Sterling builds one DORA programme with clear local ownership. Many Sterling clients are BPO, software and technology providers, so we know the evidence financial-sector customers ask providers for.
One team in 60+ countries, since 2003
Security, continuity and risk programmes for financial services firms, BPOs and software companies in every region we serve, with one engagement team answering for yours wherever your entities sit.
All-inclusive proposal
Consulting, Effivity, training and Academy access sit in one proposal; tester, assessor and legal fees are listed apart. No surprises, ever.
A programme your teams can run
Fewer documents, more evidence: inventory, register, incident workflow and tests tied to daily operations, so the programme outlives the project team.
Expert and experienced consultants
Consultants advising on management systems across sectors and countries since 2003, who build the DORA programme right first time, so a supervisory request finds the records already there.
The Sterling Promise
What our DORA compliance success guarantee means
Sterling stays engaged until the agreed DORA programme outcome is reached: the framework approved and operating, the register reconciled, incidents handled through a tested process, testing under way and contract remediation moving, with your team able to answer the authority's next request itself. Plain explanations, practical delivery, the included software and learning turn the fee into lasting capability.
The engagement sets out entities, functions, scope, outcome and responsibilities. You supply accurate information and access, take the decisions the programme requires and operate the agreed controls. Your competent authority supervises compliance, and legal interpretation is for your legal advisers. Sterling's commitment is the agreed programme support, not legal advice and not a warranty against incidents, findings or supervisory measures.
Once the programme runs
What happens after DORA compliance is in place?
DORA runs on yearly and event-driven cycles: the framework reviewed at least annually and after major incidents, critical systems and continuity plans tested every year, a register that changes with each contract, reports within hours of a major incident and, for entities their authority identifies, TLPT at least every three years. The ESAs refresh the critical-provider list annually.
Under Sterling OS™ Sustain™ we keep that calendar with you: the review and its report, register upkeep, the test plan, post-incident reviews, refreshers and the internal audit, ready whenever the authority or a client asks.
FAQs
Frequently asked questions about DORA
Is there such a thing as DORA certification?
No. The Regulation contains no certification of compliance, no seal and no accredited scheme. Your competent authority supervises through reporting, requests and inspections; ICT providers are judged by their clients and, if designated critical, overseen by the ESAs. A "DORA certificate" is its issuer's own badge; ISO/IEC 27001 and ISO 22301 certificates support the evidence but certify nothing under DORA.
Does ISO/IEC 27001 or ISO 22301 certification make us DORA compliant?
No, though it is a strong start. The ICT risk management technical standard requires security policies based on leading practices and, where applicable, standards (a definition covering ISO and IEC standards), and a certified ISMS or BCMS already holds inventories, risk assessments, controls and exercise records. It does not produce what is specific to DORA: the register templates, classification and reporting to your authority, DORA's testing programme and TLPT, the Article 30 contract terms and the board's ultimate responsibility for ICT risk.
We provide ICT services to EU banks from outside the EU. Does DORA apply to us?
Not directly, unless the ESAs designate you as critical; it reaches you through your clients. Article 30 requires written terms on services, data locations, security, access to and return of data, service levels, incident assistance, cooperation with authorities, termination and training, and, for critical or important functions, contingency plans, participation in threat-led testing, unrestricted rights of access, inspection and audit, and exit support. A critical provider established outside the EU needs an EU subsidiary within 12 months of designation for financial entities to keep using it.
What is the register of information, and who keeps it?
Every financial entity keeps a register of all its ICT contractual arrangements, not only the critical ones, at entity level and, in groups, at sub-consolidated and consolidated level, on the templates of Implementing Regulation (EU) 2024/2956. It reports at least yearly on new arrangements, provides the full register on request and tells the authority in good time about planned arrangements for critical or important functions. In 2025 competent authorities had to pass the registers to the ESAs by 30 April, data that fed the first designation of critical providers.
How quickly must a major ICT-related incident be reported?
Classify it against Article 18 and the thresholds of Delegated Regulation (EU) 2024/1772. If it is major, Delegated Regulation (EU) 2025/301 sets the clocks: the initial notification within four hours of classification and no later than 24 hours after becoming aware of it, an intermediate report within 72 hours of the initial notification, and a final report within one month of the latest intermediate report, using the templates of Implementing Regulation (EU) 2025/302. Affected clients are told without undue delay. Reporting can be outsourced; responsibility cannot.
Do we have to carry out threat-led penetration testing?
Only if your competent authority identifies you, weighing your impact on the financial sector, financial-stability concerns and your ICT risk profile and maturity. Identified entities run TLPT at least every three years on live production systems, covering several or all critical or important functions, under Delegated Regulation (EU) 2025/1190. Every financial entity other than a microenterprise still tests the ICT systems supporting critical or important functions at least yearly.
How does DORA relate to NIS2?
For financial entities, DORA is the sector-specific act: its Article 1(2) makes it a sector-specific Union legal act for the purposes of Article 4 of the NIS2 Directive, (EU) 2022/2555, whose recital 28 says DORA's provisions on ICT risk management, incidents, testing, information sharing and third-party risk apply instead of the Directive's, and DORA's recital 16 calls it lex specialis. Cloud, data-centre, managed and managed security service providers can fall under NIS2 in their own right, and under DORA through their clients.
We are a small firm. What does proportionality change?
Article 4 scales the rules to size, overall risk profile and the nature, scale and complexity of your services. Microenterprises (fewer than ten persons and turnover or balance sheet of no more than €2 million, excluding trading venues, central counterparties, trade repositories and central securities depositories) are spared duties such as the internal audit of the framework and the yearly testing programme, and the entities listed in Article 16 use its simplified framework. The register and major-incident reporting apply to every financial entity in scope.
What does Sterling's 100% success guarantee mean for DORA?
Sterling stays with you until the agreed DORA programme outcome is reached, through gap analysis, implementation, testing, internal audit and your first supervisory or client reviews. The engagement defines scope and outcome; supervision, and any finding or measure, remain with your authority.
Before the first call
Prepare a useful DORA readiness brief
You can start the conversation without a register. A short account of your entities, ICT providers and who is asking will do, with seven answers:
- Who is asking, and for what: your competent authority, an internal audit, a client's DORA addendum or your own board?
- Which entities, countries and competent authorities are in scope, and do simplified-framework or microenterprise rules apply to any?
- Which business functions would you call critical or important, and which ICT systems and providers support them?
- Roughly how many ICT providers and contracts do you have, and where are the contracts kept today?
- How are ICT incidents detected, classified and escalated now, and has a major incident been reported yet?
- What exists already: an ISO/IEC 27001 or ISO 22301 system, a testing programme, continuity plans, a submitted register?
- Who can decide and give time (board, ICT, risk, procurement, legal), and which dates must the plan meet?
These answers let us scope the work and fix a realistic fee. They support a conversation, not a scored assessment, a legal opinion or a forecast of your supervisor's view.
Don’t be fooled by certification scams
If it takes ten days, it is not DORA compliance.
Because nobody certifies DORA compliance, the market sells substitutes: "DORA certified" badges, register spreadsheets still holding sample data, policy packs written for another firm and vendor "DORA-compliant" labels. They are cheaper than a programme until a supervisor asks how an incident was classified, or a client's auditor asks for the exit plan.
How to choose a credible DORA provider
- Ask for the list of deliverables: an approved framework and strategy, an inventory, a reconciled register, a classification and reporting procedure, a testing programme, remediated contracts and trained people, each with a named author.
- Ask what any offered "DORA certificate" actually is. The Regulation provides no certification; a badge from a consultant, vendor or platform is their own label, not a supervisory or accredited statement.
- Ask how the register will be built from your real contracts, reconciled with procurement and finance and validated against the templates, not typed from a questionnaire.
- Ask who does which task, which tester, legal or assessor costs are excluded from the fee, and who supports you when an incident or a supervisory request tests the programme.
- Ask what your people and your management body will learn, and where the records will be kept. Evidence held outside your own systems is evidence you do not control.
- Walk away from "DORA compliant in ten days", "DORA certified" seals and one template pack for every firm. Compliance is shown by arrangements that operate and records that prove it; Article 5 leaves responsibility with your management body.
Keep exploring
More on DORA and related standards
Every DORA guide
More in Financial services, payments & AML
Talk to a consultant
Plan your DORA compliance with confidence.
Tell us your goals, locations and target date. We’ll help you define the scope, timeline and next steps.
hello@sterling-grc.com+1 201 263 4443 (global headquarters) · your nearest office and its number are at the top of this page
What would you like to achieve?
Choose a starting point. The enquiry form takes about a minute.
Book my free discovery callContinue to the enquiry form to share your details. Please do not include passwords, sensitive personal information or confidential files. A Sterling consultant replies within one working day. Privacy notice