DORA · Regulation (EU) 2022/2554
DORA compliance for financial entities.
DORA sets requirements for ICT risk management, incident reporting, resilience testing and ICT third-party risk at financial entities. With Basenorm you organise them on your ISO 27001 ISMS, in one EU-native platform.
Hosted in the Netherlands. Your data stays in the EU.In brief
- Type
- EU regulationDirectly applicable in every member state
- Applies from
- 17 January 2025With technical standards from the European supervisory authorities
- Applies to
- Financial entitiesSuch as banks, insurers, investment firms and payment institutions
- Third parties
- ICT service providersCritical providers come under EU oversight
01 / What DORA asks
What DORA
asks of you.
DORA brings digital operational resilience into one framework for the financial sector. Proportionality applies: the requirements depend on the size and risk profile of the entity.
- 1ICT risk management
A documented ICT risk management framework, for which the management body is responsible.
- 2ICT incident reporting
Classify ICT-related incidents and report major incidents to the competent authority.
- 3Resilience testing
Test your digital operational resilience; some entities perform threat-led penetration testing.
- 4ICT third-party risk
Manage risks from ICT service providers, with contractual requirements and exit strategies.
- 5Register of information
Keep a register of all contractual arrangements with ICT third-party service providers.
- 6Information sharing
Optionally share cyber threat information with other financial entities.
Detailed requirements follow from the regulatory and implementing technical standards.
02 / With your ISMS
DORA on what you already have.
| Topic | Your ISO 27001 ISMS | What DORA adds |
|---|---|---|
| ICT risk management | Risk assessment, treatment and Annex A controls | A formal ICT risk management framework under the responsibility of the management body |
| Incidents | Incident management controls | Classification criteria and reporting of major ICT incidents |
| Testing | Technical vulnerability management and internal audit | A resilience testing programme, and threat-led penetration testing where required |
| Third parties | Supplier relationship controls | Contractual clauses, exit strategies and the register of information |
ISO 27001 gives you a solid base for DORA. Whether your measures meet DORA is assessed per entity and per requirement.
03 / In practice
REGULATION (EU) 2022/2554DORA in
practice.
DORA is a regulation, so it applies directly in every member state. Technical standards from the European supervisory authorities set out the details.
Read about ISO 27001In force. The regulation entered into force.
Applies. Financial entities must meet the requirements from this date.
Technical standards. Detailed rules, for example on incident classification and the register of information.
Source: Regulation (EU) 2022/2554 and the related technical standards.
04 / In Basenorm
How Basenorm supports you.
Unified Control Library
See which of your ISO 27001 controls also count for DORA.
02Governance Graph
Connect ICT services, third-party providers, risks, controls and owners.
03AskNorman
Ask what is still open for DORA, in Basenorm or via MCP from ChatGPT, Claude or Perplexity. You review the evidence yourself.
05 / Questions
Questions about
DORA.
Does DORA apply to us?
DORA applies to financial entities in the EU, such as banks, insurers, investment firms and payment and e-money institutions, and to ICT third-party service providers designated as critical. Proportionality applies to smaller entities.
How does DORA relate to NIS2?
For financial entities DORA is the sector-specific law for digital operational resilience. Where DORA applies, it takes precedence over the corresponding NIS2 requirements.
Is ISO 27001 enough for DORA?
Not on its own. It covers much of ICT risk management, but DORA adds requirements such as incident classification, resilience testing and the register of information.
What is the register of information?
A register of all contractual arrangements with ICT third-party service providers, which financial entities keep and provide to their competent authority.
Does Basenorm test our resilience?
No. Basenorm helps you organise your measures, evidence and third parties. Testing is done by your own team or by specialised testers.
Book a demo
Organise DORA on your ISO 27001.
In a demo we look at your ICT risk management, your third parties and what DORA adds.
- Which ISO 27001 controls you can reuse for DORA.
- How you manage ICT third parties and the register.
- How you organise incidents and testing.
Hosted in the Netherlands. Your data stays in the EU.