Quick summary
What DORA is
DORA (Digital Operational Resilience Act) is the European regulation that requires the financial sector to withstand, respond to and recover from disruptions related to information and communication technologies (ICT): cyberattacks, system failures, supplier failures. It brings together in a single text rules that were previously scattered across sector guidelines and national laws.
Because it is a regulation, it applies directly in all Member States, with no need for transposition. What each country defined was the designation of the competent authorities and the penalty regime. In Portugal, Law No. 73/2025, of December 23, 2025, provided that national implementation.
For the financial entities covered, DORA is treated as a specific sectoral regime: as a rule, DORA's ICT risk management and incident reporting apply instead of the equivalent rules in NIS2.
Timeline and deadlines
- Jan. 16, 2023DORA Regulation enters into force. The two-year preparation period begins.
- 2024 – 2025Technical standards adopted (incident classification, reporting templates, register of information, TLPT testing), supplementing the regulation.
- Jan. 17, 2025DORA becomes applicable across the European Union.
- Apr. 2025First submission of the register of information on contracts with ICT providers to the competent authorities.
- Nov. 18, 2025First 19 critical ICT providers designated by the European Supervisory Authorities (EBA, EIOPA and ESMA). Those from third countries have 12 months to set up a subsidiary in the EU.
- Dec. 23, 2025Law No. 73/2025 published in Portugal: competent authorities and penalty regime.
- 2026 onwardActive supervision phase. The authorities check the register of information, contracts, testing and reporting capability.
Covered entities
Financial entities (Article 2)
DORA covers around 20 types of financial entities, including:
- Credit institutions (banks)
- Payment institutions and electronic money institutions
- Account information service providers
- Investment firms
- Crypto-asset service providers and issuers of asset-referenced tokens
- Central counterparties and central securities depositories
- Trading venues and trade repositories
- Managers of alternative investment funds and UCITS management companies
- Insurance and reinsurance undertakings
- Insurance and reinsurance intermediaries
- Institutions for occupational retirement provision
- Credit rating agencies and administrators of critical benchmarks
- Crowdfunding service providers
- Securitization repositories and data reporting service providers
Exclusions and simplified regimes are provided for in specific cases (for example, certain small, non-interconnected entities). Confirm how your entity is classified under Article 2 of the regulation.
ICT service providers
ICT service providers (cloud, software, data centers, managed services, data analytics, platforms) come under DORA in two ways: indirectly, through the contracts that financial entities are required to have with them, and directly, if they are designated as critical ICT providers, in which case they are supervised by the European authorities.
Proportionality
The rules apply proportionately to the entity's size, risk profile and complexity (Article 4). There is a simplified ICT risk management framework for certain small, non-interconnected entities, and microenterprises are exempt from advanced TLPT testing.
Requirements: the five pillars
ICT risk management
A documented framework approved by the management body, covering identification of assets and critical functions, protection, detection, response, recovery and backups. Management is accountable (Article 5) and must receive training.
Incident management and reporting
A process to detect, classify and handle incidents, and to report major ones to the authority within short deadlines, using harmonized templates.
Operational resilience testing
A program of regular testing and, for identified entities, advanced threat-led penetration testing (TLPT).
ICT third-party risk
A register of all contracts with ICT providers, prior assessment, mandatory clauses, exit strategies and oversight of critical providers.
Information sharing
Voluntary exchange of cyber threat information and intelligence among financial entities, within trusted communities.
Incident reporting
Major ICT incidents are reported to the competent authority (in Portugal, Banco de Portugal is the central point of contact for reporting major incidents, coordinating with CMVM and ASF). The classification of what counts as “major” rests on criteria set out in technical standards: critical services affected, number of clients, duration, geographical spread, data loss and economic impact.
Reporting of significant cyber threats is voluntary. Whenever clients may be affected, the entity must also inform them. For certain entities there are special rules when the deadline falls on a weekend or public holiday.
Resilience testing
- Regular testing. All entities (except microenterprises) maintain a testing program: vulnerability assessments, source code analysis, scenario-based tests, performance tests and penetration tests. Systems that support critical or important functions are tested at least once a year.
- Threat-led penetration testing (TLPT). At least every 3 years, for entities identified by the authorities based on impact on the sector, systemic relevance and ICT risk profile. It covers critical or important functions in production, including outsourced services, and follows the European TIBER-EU framework.
- Who tests. Internal testers can take part, but external testers must be engaged at least every third test, and significant credit institutions use external testers only.
ICT providers and contracts
Third-party risk is one of the most demanding topics in practice. Entities must:
- Maintain an up-to-date register of information covering all contractual arrangements with ICT providers, in the format defined by the technical standards, available to the authority and submitted periodically.
- Assess the supplier before contracting, including risk concentration and subcontracting.
- Include mandatory clauses (Article 30): description of the services and service levels, locations of data processing and storage, access, inspection and audit rights, cooperation during incidents, portability and transition assistance, and a documented exit from the service.
- Have a tested exit strategy for critical or important functions.
For critical ICT providers, supervision is direct: a lead overseer (EBA, EIOPA or ESMA) can request information, carry out inspections and issue recommendations. On November 18, 2025, the first 19 providers were designated, including major cloud, software and financial infrastructure providers.
Supervision and penalties
DORA does not set a single European fine amount for financial entities: each Member State defines its own penalty regime (Article 50), which must be effective, proportionate and dissuasive.
| Who | How they are sanctioned |
|---|---|
| Financial entities (Portugal) | Regime of Law No. 73/2025, enforced by Banco de Portugal, CMVM and ASF: high-value fines for the most serious infringements, applicable to legal persons and also to natural persons, with public disclosure of decisions and ancillary penalties. |
| Critical ICT providers | Daily periodic penalty payments, which can reach 1% of average daily worldwide turnover, for a period of up to 6 months, to compel compliance. |
| Management body | Members of the management body are responsible for defining, approving, reviewing and overseeing the ICT risk management framework, and can be personally sanctioned. |
The exact tiers and amounts of the Portuguese fines should be checked in Law No. 73/2025. We do not reproduce them here to avoid transcription errors.
How we do it
We help financial entities and their suppliers turn DORA into a work program with owners and deadlines, in six steps.
- Scoping. We confirm whether the entity is covered, which proportionality regime applies and the role of each supplier.
- Gap analysis. We compare your current situation with the five pillars, the technical standards and the supervisor's expectations.
- ICT risk framework and governance. Policies, critical functions, assets, risk appetite and approval by the management body.
- Third parties and contracts. Register of information, supplier assessment, review of Article 30 clauses and exit strategies.
- Incidents and testing. Classification and reporting process (4 hours, 24 hours, 72 hours, 1 month), simulation exercises and a testing program, including TLPT preparation.
- Evidence and continuous improvement. Documentation ready for the supervisor and periodic reviews.
If you are an ICT provider to financial entities, we also prepare your response: a security evidence pack, standard contract clauses, an incident reporting policy and a service exit plan.
Frequently asked questions
My company is a small financial firm. Does DORA apply?
Yes, DORA applies to financial entities of all sizes covered by Article 2, but with proportionality. Some small, non-interconnected entities have a simplified ICT risk management framework, and microenterprises are exempt from TLPT.
I am a software or cloud supplier to a bank. What changes for me?
The contract now has to include the Article 30 clauses, the bank includes it in its register of information, and it can request audits, exit plans and cooperation during incidents. If the supplier is designated as critical, it also comes under direct European supervision.
Do DORA and NIS2 apply at the same time?
For financial entities, DORA prevails on ICT risk management and incident reporting. NIS2 may still be relevant for group entities or for other activities outside the financial sector. We do this scoping in the assessment.
Which reporting deadlines do we have to meet?
Initial notification within 4 hours of classification and at the latest 24 hours after becoming aware of the incident, an intermediate report within 72 hours after that, and a final report within one month of the last intermediate report.
What is the register of information?
It is the structured inventory of all arrangements with ICT providers, with the data defined in the technical standards, which the entity must keep up to date and submit to the competent authority. It is the basis for assessing risk concentration and supplier dependency.
We are already in 2026 and have not started. Are we in breach?
DORA has applied since January 17, 2025, so there are likely to be gaps to fix. The best path is a quick assessment to understand where the biggest gaps are (usually the contract register, testing and incidents), then prioritize and document the remediation plan.
Sources and legal notice
- Regulation (EU) 2022/2554 (DORA), EUR-Lex
- FMA (Austria), DORA incident reporting deadlines
- Commission Delegated Regulation (EU) 2024/1772 (incident classification) and Commission Delegated Regulation (EU) 2025/301 (content and timelines of reporting)
- Commission Delegated Regulation (EU) 2025/1190 (TLPT testing)
- Lei n.º 73/2025, de 23 de dezembro (Law No. 73/2025 of December 23, national implementation of DORA in Portugal)