The EU's operational resilience regulation for finance. DORA sets binding requirements for how financial entities and their critical technology providers manage ICT risk, withstand disruption, and recover from it.
The Digital Operational Resilience Act is an EU regulation, in force since January 2025, that harmonises ICT risk management across the financial sector. It applies to banks, insurers, investment firms, and a wide range of other financial entities — and, critically, to the ICT third parties that serve them.
Its requirements span ICT risk management, incident classification and reporting, digital operational resilience testing, and the management of third-party ICT risk, including oversight of critical providers.
DORA is regulatory compliance, not a certification — but a structured ISMS gives you most of the control foundation it requires.
All EU financial entities fall directly within DORA's scope.
From investment firms to crypto-asset service providers.
Technology vendors serving the financial sector face direct obligations.
Delivered through our specialist network. We assess you against each DORA pillar, build the ICT risk-management and incident-reporting capability it demands, and align it with your existing security work — so resilience is operational, not just documented.
We define the boundary of your programme — systems, locations, and teams in scope — and agree the timeline and responsibilities up front, so there are no surprises later.
A structured assessment of your current posture against every requirement, producing a prioritised remediation plan with realistic effort estimates.
We write the policies, procedures, and controls, and work alongside your engineering team on a weekly cadence to implement them — not a stack of templates left for you to figure out.
The management system runs and generates evidence. We drive the internal audit and management review so the programme is demonstrably working before any external scrutiny.
We prepare the evidence package and sit alongside you through assessment, answering the assessor's questions directly rather than leaving you to defend the work alone.
DORA applies directly to banks, insurers, investment firms, payment and e-money institutions, crypto-asset providers and many other EU financial entities. Just as importantly, it reaches the ICT providers that serve them, wherever those providers are based. A UK or US software company selling to an EU bank will usually meet DORA through contract terms, questionnaires and audit rights, even if the regulation does not apply to it directly.
What financial entities must show. Four areas carry most of the work: an ICT risk management framework approved by the management body, classification and reporting of major ICT incidents, a programme of digital operational resilience testing, and control of third-party ICT risk, including a register of information on every ICT contract.
What suppliers should expect. If you serve EU financial customers, expect requests for security evidence, incident notification commitments, exit and continuity plans, sub-outsourcing details and the right to audit. Having an ISO 27001 certificate does not make you DORA-compliant, but a working ISMS answers a large share of these requests. See our ISO 27001 page.
Remote-first delivery. ISONEX works remotely with clients across the GCC, UK, EU and US. We run the gap assessment against the DORA pillars, build the documentation and processes, and prepare the evidence customers and supervisors ask for. This page is general information, not legal advice. Book a free advisory session.
It can. If you provide ICT services to EU financial entities, you may face obligations as a third-party provider, and critical providers come under direct EU oversight. We help you determine your exposure.
ISO 27001 gives you a large part of the ICT risk-management and control foundation DORA requires, so the two are complementary. We build DORA on top of an ISMS where one exists, and stand one up where it doesn't.
Not directly, unless you are an EU financial entity or are designated as a critical ICT third-party provider. In practice, UK and US companies that provide ICT services to EU financial entities meet DORA through their customers' contractual and due-diligence requirements.
No. DORA is an EU regulation enforced by financial supervisors, so there is no DORA certificate. You show compliance through documented controls, testing, incident processes and third-party management. A framework such as ISO 27001 gives you much of the foundation.
Typically security and resilience evidence, incident notification terms, business continuity and exit plans, details of subcontractors, and audit and access rights. We help you prepare these answers before the customer asks.
Yes. ISONEX is a remote-first consultancy and we deliver compliance programmes for clients in the EU, the UK, the US and the GCC. Everything is done online, scheduled around your working hours.
Book a free advisory session and we'll map your fastest credible route to compliance.
Book a free advisory session