DORA Compliance: Five Pillars, One Platform

DORA applies to a wide range of financial entities operating in the EU, including credit institutions (banks), payment institutions, electronic money institutions, investment firms, insurance and reinsurance undertakings, crypto-asset service providers, and central securities depositories. ICT third-party service providers — including cloud providers, data analytics firms, and software vendors that serve EU financial entities — are also within scope, even if based outside the EU. 

DORA organises its requirements across five pillars: ICT risk management, ICT-related incident reporting and classification, digital operational resilience testing, ICT third-party risk management, and information sharing. Each pillar carries specific obligations — from maintaining a comprehensive risk management framework, to reporting major incidents within defined timeframes, to conducting Threat-Led Penetration Testing every three years for significant entities. 

Penalties for DORA non-compliance can reach €10 million or 5–10% of total annual worldwide turnover — whichever is higher — for financial entities. Critical ICT third-party providers found non-compliant can face periodic penalty payments of up to 1% of average daily global turnover until they achieve compliance. The European Supervisory Authorities and national competent authorities are responsible for enforcement. 

Threat-Led Penetration Testing (TLPT) is an advanced form of resilience testing required by DORA for significant financial entities. It involves red team exercises conducted against live production systems, designed to simulate realistic cyber threat scenarios. TLPT must be conducted every three years and must follow the TIBER-EU framework or an equivalent national methodology. The process requires co-ordination with competent authorities and involves both the financial entity and, in some cases, its critical ICT third-party providers.

DORA is sector-specific mandatory EU law — it applies exclusively to financial entities and their ICT providers, and compliance is enforced through supervisory oversight and financial penalties. NIS-2 is a broader EU cybersecurity directive applying across critical sectors, with requirements implemented through national law in each EU member state. ISO 27001 is a voluntary international certification standard for information security management. Financial entities subject to DORA may also need to address NIS-2 obligations and may use ISO 27001 as part of their control framework, but DORA sets the primary compliance baseline for digital operational resilience in financial services.