The Digital Operational Resilience Act (DORA) is an EU regulation similar to the GDPR but for digital products and services instead of personal data. DORA is developed specifically for the financial sector and, somewhat simplified, all companies under the supervision of the Financial Supervisory Authority are covered by DORA. But even companies that are not directly supervised may need to comply with DORA if their customers are financial institutions.

The objective of DORA is to ensure that the financial sector is able to withstand, properly manage and effectively recover from all types of disruptions and threats to their IT services (more specifically, ICT-related threats and incidents where "ICT" stands for information and communication technology).

Overall requirements for DORA compliance

1. Make sure you have identified and documented relevant risks and threats.
2. Make sure you have an inventory of your IT systems and assets, including a classification of how critical they are to your business.
3. Implement a robust management of identified threats and risks.
4. Be ready to be able to properly report major IT-related incidents to the relevant authorities.
5. Conduct regular tests of your digital operational resilience.
6. Make sure to proactively manage risks from your suppliers.

What if we are not subject to competent authority supervision but our customers are?

If you are not subject to supervision, you are unlikely to be required to comply with DORA in full. However, if you have customers in the financial sector, they are responsible for managing both internal and external risks, with third-party providers being an important and central point to manage. Therefore, it is important for your customers that you have control over your security and provide them with support and assistance to manage their DORA compliance.
‍
We strongly recommend that you are proactive in understanding and ensuring which parts of DORA affect you and that you meet the requirements placed on your product and organization. We also recommend that you proactively contact your customers and demonstrate that you are aware of and in control of DORA.