DORA is a regulation that requires entities in the financial sector to ensure they can withstand, respond to, and recover from all types of ICT-related incidents, risks, and threats.

Financial entities must establish and maintain an effective ICT risk management framework to effectively identify, classify, and reduce ICT risks.

1. Incident management: Financial entities must establish effective incident management and a harmonized framework for reporting major ICT-related incidents to regulatory bodies, facilitating a better understanding of emerging threats and enabling coordinated responses.
2. Digital operational resilience testing: Financial entities must conduct regular testing to assess their capacity to withstand ICT disruptions. This includes vulnerability assessments and penetration testing, with requirements tailored to the entity’s size and risk profile.
3. Third-party risk management: Recognizing the increasing reliance on third-party service providers, including cloud services, DORA sets out rules for managing ICT risks in the supply chain, ensuring that financial entities have oversight over the resilience of their critical third-party providers.
4. Information and intelligence sharing: DORA encourages financial entities to share cyber threat intelligence and other relevant information to enhance collective understanding and defense mechanisms against ICT threats.