DORA

How it works

DORA is a regulation. Its Article 64 says it applies from 17 January 2025 and that it is binding in its entirety and directly applicable in all Member States. The European Insurance and Occupational Pensions Authority (EIOPA) describes it as designed to strengthen financial entities' ability to withstand, respond to and recover from ICT disruptions such as cyberattacks or system failures. EIOPA says it applies to "20 different types of financial entities and ICT third-party service providers", naming banks, insurance companies and investment firms among them.

EIOPA summarizes the obligations in four areas: ICT risk management frameworks, monitoring risks from ICT third parties, digital resilience testing, and reporting major ICT incidents to competent authorities.

What Article 5 says about the management body

Article 5 is headed Governance and organisation. Article 5(2) says the management body of the financial entity shall define, approve, oversee and be responsible for the implementation of all arrangements related to the ICT risk management framework referred to in Article 6(1). The management body shall, among other things:

• bear the ultimate responsibility for managing the financial entity's ICT risk (point a);
• set clear roles and responsibilities for all ICT-related functions (point c);
• bear the overall responsibility for setting and approving the digital operational resilience strategy, including the risk tolerance level of ICT risk (point d);
• approve, oversee and periodically review the ICT business continuity policy and ICT response and recovery plans (point e);
• allocate and periodically review the budget for digital operational resilience needs, including security awareness programmes and training (point g);
• put in place reporting channels so it is informed of ICT third-party arrangements and at least major ICT-related incidents and their impact (point i).

Article 5(4) says members of the management body shall actively keep up to date with sufficient knowledge and skills to understand and assess ICT risk, including by following specific training on a regular basis.

How it connects to executive and credential exposure

DORA is about the operational resilience of financial entities, not about executives' personal data. The connection is practical. Stolen credentials can be a route into ICT systems, and the people with the broadest access are often senior. CEM gives the management body a dated record of each leader's breach exposure, a concrete input for an ICT risk discussion. The link to DORA is indirect, because the regulation sets no specific breach-exposure check. NIS2 and DORA: what management bodies must approve, oversee and learn compares what each regime asks of leadership.

Practical steps

Counsel and the risk function own the scope and compliance decisions. In practice, organizations map their ICT risk framework to the regulation, track third-party providers, test resilience on a defined schedule and rehearse incident reporting. This page is general information and not legal advice.

How it differs from related terms

NIS2 is a directive that Member States turn into national law and applies across many sectors. DORA is a regulation specific to the financial sector and its ICT providers. GDPR Article 33 is a data protection duty about personal data breaches. A single incident at a bank can fall under more than one regime.