DORA — Digital Operational Resilience Act
ICT risk management, incident reporting, resilience testing and third-party risk for financial entities.
- Issued by
- European Union
- Applies in
- European Union
- Edition
- Regulation (EU) 2022/2554 — applies since 17 January 2025
- Area
- Operational resilience & ICT
What an assessor reads first.
The headline requirements in Amoreg’s catalogue, in the issuer’s own numbering where it has one. They are where a review starts, not a transcription of the text.
- Art.5Governance: management body accountability for ICT riskGovernance
- Art.6ICT risk management frameworkICT risk
- Art.11Response and recovery, backup and restorationICT risk
- Art.17ICT-related incident management processIncidents
- Art.19Reporting of major ICT-related incidentsIncidents
- Art.24Digital operational resilience testingTesting
- Art.28ICT third-party risk and the register of informationThird parties
- Art.30Key contractual provisionsThird parties
How Amoreg keeps you on it.
Enable the DORA — Digital Operational Resilience Act and the Monitor suggests EBA and Official Journal as a source. Every publication it records keeps its source, stage and date.
Inspector reads your policies against these 8 requirements every week and opens a finding wherever one falls short, citing the rule and drafting the fix. A person decides what is applied.
Each week
- Read eba.europa.eu/publications-and-media
- Check the library against 8 requirements
- Open findings with drafted fixes
- Wait for a person to decide
Policy does not yet set out: governance: management body accountability for ICT risk
- Rule
- DORA — Digital Operational Resilience Act, Art.5
- Area
- Governance
- Proposed by
- Inspector
- Decided by
- A named person, once reviewed
The same ground, elsewhere.
- UK Operational Resilience (FCA SYSC 15A / PRA SS1/21)Important business services, impact tolerances, mapping and scenario testing.United Kingdom · 5 controls
- UK Outsourcing & Third-Party Risk (SYSC 8 / PRA SS2/21)Requirements for outsourcing and third-party arrangements, including critical third parties.United Kingdom · 5 controls
- CSSF Circular 20/750 — ICT and security risk managementEBA ICT and security risk guidelines applied to Luxembourg entities outside DORA's scope.Luxembourg · 5 controls
- CSSF Circular 22/806 — Outsourcing arrangementsThe single outsourcing framework, now applying to DORA entities for business process outsourcing only.Luxembourg · 5 controls
- Central Bank of Ireland — Operational Resilience & Outsourcing GuidanceThe cross-industry guidance on operational resilience and on outsourcing.Ireland · 4 controls
- MAS Technology Risk Management GuidelinesTechnology risk governance, security, resilience and third-party expectations for financial institutions.Singapore · 5 controls
Also in European Union
- EU Anti-Money Laundering Directives (4AMLD–6AMLD)The directive-based regime transposed into member state law, until the single rulebook applies.European Union · 6 controls
- EU AML Regulation (single rulebook)Directly applicable AML/CFT rules for obliged entities across the Union, supervised by AMLA (operational since July 2025).European Union · 8 controls
- EU General Data Protection RegulationThe data protection regime for controllers and processors established in, or targeting, the EU.European Union · 9 controls
- EU Artificial Intelligence ActRisk-based obligations for providers and deployers of AI systems; general-purpose AI duties from August 2025, high-risk from August 2026.European Union · 6 controls
- NIS2 DirectiveCybersecurity risk-management measures and incident reporting for essential and important entities.European Union · 4 controls
- MiFID II / MiFIRInvestor protection, product governance, transparency and transaction reporting for investment firms.European Union · 6 controls
Questions
Does Amoreg watch for changes to the DORA — Digital Operational Resilience Act?
Yes. Enable it and the Monitor suggests European Banking Authority and Official Journal of the European Union as a source; every publication it records keeps its source, stage and date.
Can Amoreg check our policies against the DORA — Digital Operational Resilience Act?
Yes. Inspector reads your library against its requirements every week and opens a finding, with the rule it cites and a proposed fix, wherever a policy falls short. A person decides what is applied.
Which edition does Amoreg use?
The catalogue records Regulation (EU) 2022/2554 — applies since 17 January 2025. Editions were last verified in August 2026, and the Monitor records new publications as they appear.