Executive Summary: What is it?
The Digital Operational Resilience Act (DORA) is an EU regulation, in force since 16 January 2023 and applicable since 17 January 2025, that sets uniform requirements for the security and operational resilience of information and communication technology (ICT) systems across the financial sector. It applies to banks, insurers, investment firms, and crypto-asset providers. It also reaches the ICT third-party providers they depend on, through mandatory contract terms, with direct EU oversight for providers designated as critical. DORA defines no certificate. A provider can show how it supports a financial entity's duties through a trust-center entry (the vendor's public page of security and compliance claims) or an independent assessment; the obligation stays with the financial entity.
CFO / Business Impact: What does it cost/risk?
- Third-Party Accountability: Financial entities must map, monitor, and contractually govern every ICT provider, with stricter terms for those supporting critical or important functions. A vendor that cannot evidence its own resilience posture becomes a procurement blocker.
- Sovereignty Leverage: Self-hosting critical connectivity and access infrastructure keeps the resilience controls, and the audit evidence, inside the regulated entity rather than dispersed across foreign SaaS providers.
Technical Reality: How does it work?
- ICT Risk Management: Mandates documented controls for network segmentation, access management, and continuous monitoring across the ICT estate.
- Incident Reporting: Major ICT-related incidents must be classified and reported to the competent authority within regulated timeframes, backed by tested business-continuity and recovery procedures.
What the Label Means in a Solution Profile
DORA binds banks, insurers and other financial entities, and reaches their ICT providers through contracts and oversight. It defines no certificate.
- Self-Hosted line: DORA asks nothing of software, so no self-hosted line carries a DORA label.
- Managed service line: "DORA (Self-Assessed)" means the provider states in its trust center how it supports a financial entity's duties. An independent assurance report also counts only as Self-Assessed, since no audit scheme exists. The obligation stays with the financial entity.