Our summary
Regulation (EU) 2022/2554, known as DORA, was adopted on 14 December 2022, published on 27 December 2022 and has applied since 17 January 2025. It applies directly in every Member State to a wide range of financial entities, including banks, insurers, investment firms, payment and e-money institutions and crypto-asset service providers. It aims to make sure they can withstand, respond to and recover from ICT disruptions and cyber threats.
DORA has five main areas: ICT risk management (with clear responsibility for the management body), reporting of major ICT-related incidents, digital operational resilience testing (including threat-led penetration testing for larger firms), management of ICT third-party risk (including a register of all ICT contracts and required contract terms), and information sharing on cyber threats. It also creates EU oversight of critical ICT third-party providers. The European Supervisory Authorities published the first list of designated critical providers on 18 November 2025. Detailed technical standards from the EBA, EIOPA and ESMA support the regulation.
How auditors use it: In EU financial entities, use DORA as the baseline for audits of ICT risk, cyber incident response and outsourcing. Test the register of information, contract clauses and exit plans for ICT providers, incident classification and reporting times, and board oversight. DORA itself expects the ICT risk management framework to be audited regularly.