Get audit-ready for DORA
DORA (EU 2022/2554) · Digital Operational Resilience Act
EU regulation establishing uniform requirements for the security of network and information systems of financial entities, ensuring digital operational resilience across the financial sector.
DORAWhat is DORA?
EU regulation establishing uniform requirements for the security of network and information systems of financial entities, ensuring digital operational resilience across the financial sector.
Who it applies to
EU financial entities and, notably, the critical ICT providers serving them - which pulls technology suppliers directly into scope rather than reaching them through their customers contracts.
How the standard is organised
Pillars covering ICT risk management, incident reporting, resilience testing, third-party risk and information sharing. As a Regulation it applies directly in every member state without national transposition.
Framework names, marks and abbreviations (ISO, SOC 2, PCI DSS, TISAX, HIPAA, GDPR and others) are trademarks of their respective standards bodies and are used here only to describe what the Bitkosh Readiness Platform helps you track and prepare for. The badges shown are original Bitkosh artwork, not the official marks. Bitkosh Technologies is not affiliated with, sponsored by, or endorsed by ISO, AICPA, the PCI Security Standards Council, ENX/VDA, or any other framework owner, and using this platform does not by itself confer or guarantee certification — certification/attestation is granted only by the relevant accredited third-party body.
DORA on the Bitkosh platform
The 80 DORA controls sit in one workspace with gap assessment, evidence collection and your readiness score, and shared controls count towards the equivalent requirement in the other 47 ready frameworks at the same time — so a second framework costs a fraction of the first.
How the platform worksSample controls
Six controls from the platform's control library, chosen because they are the most specific to this framework.
- Art. 19(4)Initial, intermediate and final reports
Submit an initial notification, an intermediate report and a final report on each major incident within the set timelines.
ICT Incident Management - Art. 12(5)Secondary processing site (central securities depositories)
Central securities depositories maintain at least one secondary processing site able to ensure the service level of the primary site; this is not a duty for other entity types.
ICT Risk Management - Art. 19(3)Informing clients of major incidents
Inform clients without undue delay of major incidents that impact their financial interests and of measures taken.
ICT Incident Management - Art. 30(3)Added provisions for critical functions
For critical or important functions, add full service levels, notice periods, contingency testing, participation in training and monitoring rights.
ICT Third-Party Risk - Art. 12(3)-(4)Segregated restore systems and redundant capacity
Restore backup data on systems physically and logically segregated from the source system, and maintain redundant ICT capacity adequate to meet business needs.
ICT Risk Management - Art. 30(4)Standard contractual clauses
Consider using standard contractual clauses developed by public authorities for specific services when contracting for ICT services.
ICT Third-Party Risk
More financial & operational resilience frameworks
Frequently Asked Questions
Who publishes DORA, and who does it apply to?
How is DORA conformance demonstrated?
How is DORA structured?
Ready to get audit-ready for DORA?
See how the Bitkosh Readiness Platform gets you audit-ready for DORA — and the other 47 ready frameworks — from a single control library.