DORA

DORA, the EU Digital Operational Resilience Act, is European Union regulation that requires banks, insurers, and other financial entities to manage information and communication technology risk and maintain operational resilience across their technology stack and third party providers.

DORA became applicable across the EU in January 2025 and covers a wide range of financial entities, including banks, insurance and reinsurance companies, investment firms, and payment institutions, along with the critical ICT third parties that support them. It brings together several requirements that many financial entities previously handled separately: an ICT risk management framework covering the full technology stack, a register of information documenting every ICT third party arrangement supporting the business, mandatory reporting of major ICT related incidents within defined timelines, regular digital operational resilience testing, and ongoing oversight of the critical third party providers a firm depends on.

The third party register and dependency mapping requirements are where DORA becomes a data problem as much as a compliance one. A financial entity has to be able to show which established systems, applications, and vendors sit behind each of its critical or important business functions, and how data flows through that chain, not as a point in time diagram but as something that stays accurate as systems change. For firms running large, interconnected technology estates built up over years, assembling and maintaining that map by hand is one of the harder parts of the regulation to satisfy convincingly.

How DORA Relates to Adjacent Terms

BCBS 239 is an earlier risk data aggregation standard for banks with a related but narrower focus on risk reporting; DORA is broader, covering operational resilience and ICT risk across a wider set of financial entities. Model risk management addresses the risk inside specific models, while DORA addresses the resilience of the technology and third party ecosystem those models and systems run on. And cross platform lineage is the technical capability that makes DORA's dependency mapping requirement answerable with evidence rather than a static diagram.

What DORA Resilience Requires From Data Systems

For a governance and compliance leader at a financial entity, DORA's ICT third party register and dependency mapping obligations require a current, provable answer to which systems and vendors sit behind each critical function and how data moves between them. Spreadsheets and architecture diagrams go stale the moment a team ships a change, which is exactly when a regulator or auditor might ask for the current picture. Meeting that bar requires the kind of technical visibility, lineage, and dependency knowledge that source code analysis provides: a dependency map generated directly from how systems and services actually call each other in the code, kept current as the codebase changes, giving compliance teams documentation that holds up under regulatory review.

Related Terms

• BCBS 239
• Model risk management
• Cross platform lineage

Frequently Asked Questions

Which companies does DORA apply to?

DORA applies to a broad range of EU regulated financial entities, including banks, insurance and reinsurance companies, investment firms, and payment institutions, as well as the critical ICT third party providers that support them. If your organization is an EU regulated financial entity or a key technology provider to one, DORA is worth confirming applicability for directly rather than assuming it does not apply.

What is the ICT third party register DORA requires?

It is a documented record of every ICT third party arrangement supporting a financial entity's operations, including which vendors and systems support which critical or important business functions. Regulators can request this register, so it needs to be accurate and current, which is difficult to maintain by hand once a technology estate includes many interconnected systems that change regularly.

How is DORA different from GDPR?

GDPR governs personal data specifically: what organizations can do with it and what rights individuals have over it. DORA governs the operational resilience of the technology and third party ecosystem a financial entity relies on, covering ICT risk management, incident reporting, and third party dependencies, regardless of whether personal data is involved. A financial entity handling personal data is typically subject to both.