The Five Pillars of DORA

Establishes comprehensive requirements for financial entities to identify, protect against, detect, respond to, and recover from ICT-related disruptions. Mandates a robust governance framework with clear roles, policies, and continuous improvement processes for managing technology risk across the organization.

Requires financial entities to establish and implement an incident management process for detecting, managing, and reporting ICT-related incidents. Introduces harmonized classification criteria, mandatory reporting timelines to competent authorities, and obligations for root cause analysis and remediation tracking.

Mandates that financial entities establish testing programmes proportionate to their size and risk profile to assess preparedness for ICT disruptions. Includes requirements for basic testing such as vulnerability assessments, as well as advanced threat-led penetration testing (TLPT) for systemically important institutions.

Addresses the risks arising from reliance on ICT third-party service providers. Establishes principles for sound management of third-party risk including due diligence, contractual requirements, concentration risk monitoring, and an EU-level oversight framework for critical ICT third-party providers designated by the ESAs.

A single-article chapter that encourages financial entities to voluntarily exchange cyber threat intelligence and information about ICT-related vulnerabilities, tactics, techniques, and procedures among themselves and with competent authorities. Establishes safeguards for such sharing arrangements including data protection, confidentiality, and competition law compliance.