DORA (digital operational resilience)

DORA (Digital Operational Resilience Act) is regulation (UE) 2022/2554, applicable since 17 January 2025. It requires financial entities in the Union, banks, insurers, payment providers, asset managers and crypto-asset service providers, to demonstrate that they can withstand IT incidents. It rests on 5 pillars: IT risk governance, reporting major incidents to the authorities, resilience testing, management of third party provider risk, and information sharing on threats. Its most concrete effect for a software buyer is the fourth: contracts with critical IT providers must contain precise clauses on audit, reversibility and continuity.