Glossary · D · DORA

Digital Operational Resilience Act

Lit office floors of a high-rise at night

Definition

DORA, Regulation (EU) 2022/2554, governs digital operational resilience in the financial sector: ICT risk management, incident reporting, resilience testing and the management of ICT third-party providers.

Banks, insurers and other financial entities depend on IT, and increasingly on service providers. DORA requires them to withstand disruption, report it and keep their providers under control.

The regulation has applied directly in all member states since 17 January 2025. The full text is on EUR-Lex. In Germany, BaFin supervises implementation.

#Five pillars

Pillar	Core
ICT risk management	Framework, management accountability, protection, detection, recovery
Incidents	Classify incidents and report major ones
Resilience testing	Regular tests; threat-led penetration testing for certain entities
ICT third-party risk	Contracts, register of information, exit strategies
Information sharing	Voluntary exchange on cyber threats

#Providers in focus

For customer service, the fourth pillar matters most. A contact centre platform is an ICT third-party service provider. Financial entities keep a register of information on all such arrangements and assess whether a service supports critical or important functions.

Contracts must cover the minimum content under Art. 30, including where data is processed, access, inspection and audit rights, assistance during incidents, termination rights and, for critical functions, exit strategies.

For providers designated as critical, DORA adds direct oversight by the European supervisory authorities (Art. 31 ff.). That does not change the financial entity's responsibility for its own contracts.

Questions for an ICT provider

Where is data processed, and by whom?

How, and how quickly, are incidents reported?

Which audit and access rights apply?

What does an orderly exit look like, including data export?

How is the platform tested, and who sees the results?

Two colleagues talking in a dimly lit office — Resilience shows during disruption: customer service has to keep running when other systems fail.

#Customer service as a critical function

Each financial entity decides for itself whether customer service is a critical or important function. But failing to reach customers during an outage quickly becomes a second problem. So plan fallback routes and announcements as well.

#DORA and Univerx

Univerx is designed to support banks and insurers with documents for their ICT third-party risk management under DORA. Which documents are available, we tell you on request.

Details in the Trust Center under DORA. Industry context: Banking & financial services and Insurance.

All terms