ICT risk management
A documented framework covering identification, protection, detection, response, recovery, learning and communication, with the management body ultimately accountable.
Digital Operational Resilience Act
DORA compliance and resilience testing for financial entities.
The Digital Operational Resilience Act sets harmonised ICT risk, incident reporting, testing and third-party requirements for EU financial entities. We help Irish and EU firms turn DORA from a documentation exercise into resilience they can evidence to the Central Bank.
At a glance
DORA is in force and supervised.
DORA (Regulation (EU) 2022/2554) has applied since 17 January 2025. As a regulation, it applies directly without national transposition. In Ireland, the Central Bank of Ireland supervises DORA and is the designated authority for threat-led penetration testing (TLPT) through its TIBER-IE programme.
Supervisors have moved from awareness to oversight. Firms are now expected to show that their ICT risk framework operates, that major incidents are classified and reported on time, and that critical ICT providers are managed and recorded.
| Instrument | Regulation (EU) 2022/2554 (DORA) |
|---|---|
| Applies since | 17 January 2025 |
| Irish competent authority | Central Bank of Ireland |
| TLPT in Ireland | TIBER-IE, run by the Central Bank for firms it identifies as in scope |
| Testing cadence | Annual testing of systems supporting critical or important functions; TLPT at least every three years for selected firms |
| Third-party records | Register of information on all ICT third-party arrangements |
Scope
Who DORA applies to.
DORA covers around twenty types of financial entity, including credit institutions, payment and e-money institutions, investment firms, crypto-asset service providers, central securities depositories, trading venues, insurers and reinsurers, insurance intermediaries, fund managers and occupational pension schemes.
- Proportionality: requirements scale with size, risk profile and complexity, and certain smaller entities may apply a simplified ICT risk-management framework under Article 16
- ICT third-party providers: providers designated as critical (CTPPs) come under direct EU oversight, and all providers to financial entities face DORA contractual clauses
- Group structures: Irish entities of international groups need to show that group-provided ICT services meet DORA requirements locally
Requirements
The five DORA pillars.
DORA groups its requirements into five areas, supported by regulatory and implementing technical standards issued by the European Supervisory Authorities.
ICT incident management and reporting
Classification of ICT-related incidents and reporting of major incidents in initial, intermediate and final stages, plus voluntary notification of significant cyber threats.
Digital operational resilience testing
A risk-based testing programme including vulnerability assessments, scenario-based tests and penetration tests, with TLPT for selected firms.
ICT third-party risk
Pre-contract due diligence, mandatory contractual provisions, concentration risk assessment, exit strategies and the register of information.
Information sharing
Voluntary arrangements for sharing cyber-threat information and intelligence between financial entities.
Governance and training
Management-body knowledge of ICT risk, approval of the framework and digital operational resilience training for staff.
Common gaps
Common DORA gaps.
- Incident classification criteria that have never been tested against a realistic incident or timed against reporting deadlines
- Registers of information built once for submission but not maintained as contracts and services change
- Contracts with ICT providers missing mandatory DORA provisions, especially for subcontracting and exit
- Testing programmes limited to annual penetration tests, with no link to critical or important functions
- Exit strategies for critical ICT services that exist only as high-level statements
- Management bodies unable to describe the firm's ICT risk tolerance or major ICT dependencies
Free checklist
DORA Readiness Checklist
A practical checklist across the five DORA pillars, covering governance, incident reporting timelines, testing, third-party risk and evidence.
FAQs
DORA questions we hear most often
When did DORA start to apply?
DORA has applied since 17 January 2025. It is an EU regulation, so it applies directly in Ireland without national transposition.
What are the DORA major incident reporting deadlines?
Under the supporting technical standards, the initial notification is due within 4 hours of classifying an incident as major and no later than 24 hours after becoming aware of it. The intermediate report follows within 72 hours of the initial notification, and the final report within one month of the latest intermediate report.
Does every firm need threat-led penetration testing?
No. TLPT applies only to financial entities identified by the competent authority. In Ireland, the Central Bank engages directly with in-scope firms through TIBER-IE and runs an identification exercise annually. All firms still need a risk-based testing programme.
Is DORA the same as NIS2 for financial services?
DORA is sector-specific legislation for financial entities and takes precedence for ICT risk, incident reporting and testing. Some groups still have NIS2 considerations for non-financial entities. See our NIS2 page.
Can automated testing help with DORA?
Yes. Continuous, authorised exposure validation helps show that controls work between annual tests and that fixes have been verified. It complements, but does not replace, penetration testing and TLPT where required.
Related services and guidance
Sources
- Regulation (EU) 2022/2554 (DORA), EUR-Lex
- Central Bank of Ireland: DORA communications and publications
- Central Bank of Ireland: TIBER-IE and DORA TLPT
- Central Bank of Ireland: DORA FAQs
- EIOPA: Digital Operational Resilience Act
This page is general guidance, not legal advice. Last reviewed 27 October 2026.