What is DORA?

DORA, which stands for the Digital Operational Resilience Act, is a new regulation in the European Union (EU) that focuses on the financial sector. Its main goal is to make sure that financial companies can handle and quickly recover from major disruptions, especially those related to information and communication technologies (ICT), like cyberattacks or system failures. Think of it as a rulebook for how banks and other financial institutions should manage their digital risks to prevent big problems.

Examples

Imagine a major bank’s online banking system goes down because of a server crash. Before DORA, the bank might not have had a clear plan to get the system back up and running quickly. Under DORA, the bank is required to have a detailed plan for this kind of event, including how it will notify customers and regulators, and how it will restore services within a specific time frame.

Another example is a payment company that uses a third-party cloud service. If that service provider has a data breach, DORA requires the payment company to have a contract in place that outlines exactly what the cloud provider’s responsibilities are for security and what happens if something goes wrong.

Context

DORA was created because the financial world is so reliant on digital technology. A single cyberattack or tech failure could have a ripple effect, causing widespread chaos and financial losses. DORA aims to create a strong, consistent approach to digital resilience across all EU financial companies. It replaces and builds upon older, less comprehensive rules. The act makes sure that companies, including those that provide digital services to the financial sector, like cloud providers, are all held to the same high standards.

Relevant ISO 27001 Controls

The following controls from the ISO/IEC 27001:2022 standard are relevant to DORA because they help organisations manage information security, a key part of digital resilience:

About the author

Stuart Barker

ISO 27001 Ninja

Stuart Barker is a veteran practitioner with over 30 years of experience in systems security and risk management. Holding an MSc in Software and Systems Security, he combines academic rigor with extensive operational experience, including a decade leading Data Governance for General Electric (GE).

As a qualified ISO 27001 Lead Auditor, Stuart possesses distinct insight into the specific evidence standards required by certification bodies. His toolkits represent an auditor-verified methodology designed to minimise operational friction while guaranteeing compliance.