Cybersecurity & Resilience

Digital Operational Resilience Act (DORA): what it contains — and why it exists

Reading time 5 min Sebastian Bach

Key takeaways

  • DORA harmonises EU expectations for ICT risk management, incident handling, resilience testing and third‑party governance for financial entities.
  • ICT third‑party concentration is a first-class problem: contractual assurances, substitution thinking and supervisory registers are mandatory themes.
  • Critical ICT third‑party providers can be designated for direct oversight by ESAs under a lead overseer model — changing how big tech dependencies are supervised.
  • EBA, EIOPA and ESMA publish RTS, guidelines and supervisory coordination — national competent authorities remain central for firms.
  • Execution requires hybrid talent across regulatory interpretation, security engineering, vendor management and crisis leadership — scarce in many markets.

Subscribe to our newsletter

Receive regular insights, strategies and best practices on IT recruitment and cybersecurity (many articles in German).

The Digital Operational Resilience Act (DORA) addresses a structural issue: modern finance runs on ICT and concentrated cloud and software supply chains — while legacy supervisory practice did not always produce comparable, examinable resilience evidence across the EU. DORA makes digital resilience a shared baseline for in-scope financial entities — with ICT third‑party governance at the centre.

This article frames why DORA exists, what building blocks enterprises implement, and who typically leads them. Not legal advice — confirm scope with your supervisory authority and primary EU texts.

Official entry points:

Policy intent

Reduce the odds that single points of ICT failure — or opaque vendor chains — create systemic disruption. That means proof, not intentions: registers, incident discipline, resilience testing, and contracts that survive real strain.

Core building blocks

  1. ICT risk management embedded in enterprise risk — not a side project.
  2. ICT-related incident management with classification aligned to ESA frameworks.
  3. Resilience testing proportional to scale and risk — scenarios that teach, not theatre.
  4. ICT third‑party management with registers, due diligence and exit/substitution analysis.
  5. Supervisory cooperation across ESAs and national authorities — with critical ICT third‑party provider (CTPP) oversight where designated.

Where programmes usually stumble

  • Registers without ownership: stale data before the first inspection.
  • Tests without remediation loops: lessons do not hit funding cycles.
  • Weak contractual co-operation: vendors stall evidence during real incidents.
  • Siloed BCM and security: neither side sees end-to-end recovery.

ESAs: standards and supervision

The EBA, EIOPA and ESMA jointly develop technical detail — for example public packages on ICT and third‑party risk and incident classification (see EIOPA newsflow on first DORA rule sets). For international groups, alignment beats local heroics: one evidence model, many entities.

Critical ICT third‑party providers

When providers are designated as critical, a lead overseer supervises them directly. For banks, insurers and markets firms, that increases the weight of concentration risk arguments in board papers — “we cannot substitute” is no longer an informal excuse.

Hiring angle: why DORA intensifies hybrid shortages

DORA rewards people who translate legal text into operating checks — who can speak to auditors and engineers credibly. Those profiles overlap with advanced cyber resilience hiring needs.

90‑day starter checklist

Practical kickoff

  • Confirm legal entity scope with counsel and supervisors.
  • Stand up ICT register with data owners and monthly QA KPIs.
  • Rank top third parties by criticality × substitutability.
  • Align incident playbooks with contractual cooperation clauses.
  • Schedule one credible cross-domain exercise with board-level lessons.

Conclusion

DORA makes digital operational resilience a supervisory constant for EU finance — especially where third‑party ICT concentrates. Winning programmes treat it as enterprise plumbing: contracts, tests, data and evidence — not a slide stack.

For scarce leadership that bridges regulation, security and execution, see cybersecurity recruitment and IT recruitment for broader delivery depth.

Recommended next step

FAQ

Does Perfomynd recruit for DORA / ICT third‑party programme roles?
Yes — commonly spanning segment IT, information security, operational risk, BCM and procurement governance. We set 12–24 month outcomes (register quality, substitutability of critical vendors, credible test cadence) and search actively, including passive talent. Shortlists are stress‑tested against supervisory dialogue, not slide decks.
Is DORA only about banks?
No. The perimeter covers multiple financial entity categories (scope depends on banking, insurance and markets frameworks as implemented). Use your competent authority and primary EU texts for definitive scoping.
How does DORA relate to NIS2?
Both tackle ICT resilience and incidents, but institutions, duties and supervisors differ. Many groups need a single enterprise ICT risk narrative while preserving legal precision — avoid “one spreadsheet solves both” oversimplification.