Since 17 January 2025, Regulation (EU) 2022/2554 (the Digital Operational Resilience Act, DORA) has applied across all European Union member states. Replacing fragmented national supervisory guidelines with a single binding regulatory regime, DORA ensures that financial entities can withstand, respond to, and rapidly recover from severe operational and cyber disruptions.
1. The Five Fundamental Pillars of DORA
DORA establishes five interconnected pillars governing the digital resilience of an estimated 22,000 financial entities across the EU:
ICT Risk Management (Articles 5–16)
Mandates an executive-approved ICT risk management framework, resilient system architectures, continuous monitoring, and automated detection tools.
ICT-Related Incident Reporting (Articles 17–23)
Harmonized criteria for classifying major ICT incidents, with compressed initial reporting (within 4 hours of classification / 24 hours of detection), 72-hour updates, and final reports.
Digital Operational Resilience Testing (Articles 24–27)
Mandatory periodic testing of ICT systems, ranging from routine vulnerability assessments to advanced Threat-Led Penetration Testing (TLPT) for designated significant entities.
Managing ICT Third-Party Risk (Articles 28–44)
Full lifecycle oversight of external vendors, maintaining the Article 28 register of information, enforcing Article 30 contractual clauses, and direct oversight of designated CTPPs.
Information & Intelligence Sharing (Article 45)
Arrangements enabling financial entities to exchange cyber threat intelligence, indicators of compromise (IOCs), and defensive tactics within trusted industry arrangements.
2. ICT Third-Party Governance: The Article 28 Register & Article 30 Clauses
Under Chapter V of DORA, financial entities remain fully responsible for fulfilling regulatory obligations regardless of whether services are hosted internally or outsourced to third-party cloud providers:
Article 28 Register of Information
Under Article 28(3), financial entities must maintain and update at entity, sub-consolidated, and consolidated levels a comprehensive register of information in relation to all contractual arrangements on the use of ICT services provided by third parties. The register distinguishes between services supporting critical or important functions and commodity services, and must be submitted to competent supervisory authorities upon request.
Key Contractual Safeguards (Article 30)
Contractual arrangements between financial entities and ICT service providers must explicitly specify:
- Access, Inspection & Audit Rights: Under Article 30(2)(g) and 30(3)(e), contracts must grant full access, inspection, and audit rights for the financial entity and competent authorities to systems and premises, following agreed audit scopes and security procedures.
- Quantitative Benchmarks & SLAs: Measurable service level benchmarks covering availability, technical response times, and recovery objectives.
- Subcontracting Controls: Prior notification and consent conditions where a service provider intends to subcontract critical or important functions.
- Termination & Exit Strategies: Transition periods and data portability requirements to prevent operational disruption during vendor offboarding.
3. Threat-Led Penetration Testing (TLPT) Scope
Threat-Led Penetration Testing under Article 26 does not apply universally to all financial entities. It is strictly required for entities identified by competent authorities based on criteria set out in the regulatory technical standards (RTS), evaluating systemic impact, financial sector criticality, and operational ICT reliance:
| Testing Level | Scope of Application | Statutory Testing Cadence |
|---|---|---|
| Standard Resilience Testing (Article 25) | All financial entities (subject to the proportionality principle). | Annual assessments, vulnerability scans, network testing, and gap analyses. |
| Advanced TLPT (Article 26) | Entities designated by competent authorities under RTS criteria (e.g., significant credit institutions, central counterparties). | Conducted at least once every three years, targeting live production environments supporting critical functions and including ICT third-party providers. |
4. Oversight of Critical Third-Party Providers (CTPPs)
For cloud providers and critical software vendors designated as Critical ICT Third-Party Service Providers (CTPPs) under Article 31, European Supervisory Authorities (EBA, ESMA, EIOPA) exercise direct oversight. Under Article 35(2), the Lead Overseer may impose periodic penalty payments of up to 1% of the average daily worldwide turnover of the CTPP in the preceding business year, applied daily for up to six months, to compel compliance with supervisory recommendations.
5. Next Steps for Financial Security Leaders
Financial security leaders should prioritize three operational objectives: auditing existing ICT vendor contracts against Article 30 requirements, populating the structured Article 28 register of information, and establishing continuous configuration monitoring to substantiate compliance during supervisory reviews.