DORA, the Digital Operational Resilience Act, is Regulation (EU) 2022/2554, the European Union's binding framework requiring financial entities to withstand, respond to and recover from ICT-related disruptions. It has applied directly in every EU Member State since 17 January 2025, without the need for national transposition.
Because DORA is a regulation and not a directive, its obligations fall on financial entities and certain ICT service providers exactly as written on EUR-Lex, and supervisors across the Union enforce a single, harmonized rulebook. Compliance officers, ICT risk managers and board members now face concrete duties: a documented ICT risk management framework, incident classification and reporting, resilience testing, third-party oversight and a register of information. This article sets out what the regulation obliges in each of those areas, which entities fall within scope, which PECB credential suits the compliance role, and how DORA relates to ISO 22301, ISO/IEC 27001 and the NIS 2 Directive.
Standards Academy teaches DORA from the governance end. The regulation's assignment of ICT risk to the management body (Article 5) is the sector-specific form of what ISO 37000, written in ISO/TC 309/WG 1 under the convenorship of Standards Academy's director, sets as general principle: the governing body oversees performance, ethical behaviour and compliance obligations (ISO, 2021, Clause 6.4) and considers the effect of uncertainty on the organizational purpose (Clause 6.9).
Scope and purpose of the Digital Operational Resilience Act
The Digital Operational Resilience Act harmonizes ICT risk requirements across the EU financial sector. Before DORA, operational resilience rules were scattered across sectoral legislation and national guidance, producing inconsistent expectations between Member States and between types of financial entity. The regulation replaces that patchwork with uniform requirements for the management of ICT risk, the handling and reporting of ICT-related incidents, digital operational resilience testing, the management of ICT third-party risk and arrangements for information sharing (Regulation (EU) 2022/2554).
Two features distinguish DORA from much of the compliance material that surrounds it. First, it is binding law. Every obligation in the regulation applies directly to the entities within its scope: there is no opt-in, no certification route that substitutes for compliance, and no national discretion over the core requirements. Voluntary standards such as ISO/IEC 27001 and ISO 22301 can support a financial entity's compliance programme, but they do not discharge any DORA obligation.
Second, DORA assigns ultimate responsibility for ICT risk management to the management body of the financial entity. Under Article 5, the management body shall define, approve and oversee the ICT risk management framework and remains accountable for its implementation. Board members and senior executives are required to maintain sufficient knowledge and skills to understand and assess ICT risk, a provision with a direct consequence: directors who could once delegate technology risk entirely to specialists shall now undergo training themselves and keep that knowledge current.
The regulation's purpose, stated in its opening recitals, is that the financial system absorbs ICT disruption without threatening financial stability. DORA compliance is therefore a matter of institutional governance as well as of ICT management.
PECB credentials and training routes for DORA
PECB offers two credentials for professionals working with the regulation, each attesting personal knowledge of DORA and its requirements. No body certifies an organization to DORA. The regulation is law, and no organizational certificate equivalent to ISO/IEC 27001 certification exists for it. PECB DORA credentials attest what an individual knows: that the holder understands the regulation's structure, obligations and implementation approaches.
The choice between the two credentials turns on the role the reader holds. The DORA Foundation credential suits professionals who need a working understanding of the regulation, internal auditors, legal counsel, board members meeting their Article 5 knowledge obligation, and staff in risk or compliance teams who interact with DORA requirements without owning them. The Lead Manager credential is the route for the person responsible for establishing, implementing and managing a DORA-aligned ICT risk management framework: typically the head of operational resilience, the ICT risk manager or the compliance officer who owns the register of information and the incident reporting process.
The following table maps each role to its credential and course. These are the training routes available through Standards Academy, and each course is delivered in Self-Study and eLearning formats.
| Role | Credential | Course | Formats |
|---|---|---|---|
| Board member, auditor or team member needing a grounded understanding of the regulation | PECB Certified DORA Foundation | DORA Foundation | Self-Study and eLearning |
| Professional responsible for establishing, implementing and managing a DORA-aligned ICT risk management framework | PECB Certified DORA Lead Manager | DORA Lead Manager | Self-Study and eLearning |
For a compliance role with direct ownership of DORA obligations, the Lead Manager credential is the appropriate target; the Foundation credential serves everyone whose work touches the regulation without carrying that ownership.
Financial entities and ICT third-party providers within scope
Article 2 of the regulation lists the financial entities within scope, and the list is long. It includes credit institutions, payment institutions, electronic money institutions, investment firms, crypto-asset service providers, central securities depositories, central counterparties, trading venues, managers of alternative investment funds, management companies, insurance and reinsurance undertakings, insurance intermediaries above certain thresholds, institutions for occupational retirement provision, credit rating agencies, administrators of critical benchmarks and crowdfunding service providers. In practice, almost any regulated organization in the EU financial sector falls within DORA's reach, although the regulation applies proportionality so that smaller and simpler entities face lighter requirements. Microenterprises, for example, are exempt from several obligations, and the entities listed in Article 16 follow a simplified ICT risk management framework.
The regulation also reaches beyond financial entities themselves. ICT third-party service providers, including cloud computing providers, software vendors, data analytics firms and data centre operators, are relevant wherever they supply ICT services to financial entities. For most providers, DORA's effect is contractual: financial entities shall impose specified terms, audit rights and exit provisions on them.
A subset of providers is subject to direct oversight. ICT third-party providers designated as critical to the financial sector fall under a Union oversight framework led by the European Supervisory Authorities (the EBA, ESMA and EIOPA). For each critical provider, one of the three authorities acts as Lead Overseer, with powers to request information, conduct investigations and inspections, and issue recommendations. Large technology firms that were never directly supervised by financial regulators are now subject to EU-level oversight because of the dependence the financial sector places on them. Concentration risk, where many institutions rely on a handful of providers, is the exposure this framework addresses (Articles 31 to 44).
The five pillars of the regulation
DORA's substantive requirements are commonly described as five pillars, each corresponding to a chapter of the regulation.
ICT risk management (Chapter II). Financial entities shall establish an internal governance and control framework for ICT risk, approved and overseen by the management body. The framework covers identification of ICT-supported business functions, protection and prevention measures, detection mechanisms, response and recovery plans, backup policies and communication plans. Article 6 requires the framework to be documented and reviewed at least once a year, and after major ICT-related incidents.
ICT-related incident management, classification and reporting (Chapter III). Entities shall detect, manage and log ICT-related incidents, classify them against criteria set out in the regulation, and report major incidents to the competent authority using harmonized templates and staged deadlines: an initial notification, an intermediate report and a final report (Article 19). Significant cyber threats may be reported voluntarily.
Digital operational resilience testing (Chapter IV). All in-scope entities shall run a proportionate testing programme, including vulnerability assessments and scenario-based testing. Entities identified for advanced testing shall carry out threat-led penetration testing (TLPT) at least every three years, covering live production systems and, where relevant, involving ICT third-party providers.
ICT third-party risk management (Chapter V). Entities shall manage ICT third-party risk as part of the overall framework, maintain a register of information, assess concentration risk and see that contracts contain the provisions Article 30 prescribes. Chapter V also houses the oversight framework for critical providers.
Information-sharing arrangements (Chapter VI). Financial entities may exchange cyber threat information and intelligence within trusted communities, provided the arrangements protect confidentiality and comply with data protection rules. Unlike the first four pillars, this one is voluntary: the regulation enables sharing (Article 45).
Together the five chapters form a single, connected discipline: governance feeds testing, testing informs incident response, and third-party oversight runs through all of it.
ICT third-party risk and the register of information
Of the five pillars, ICT third-party risk is the one generating the most practical work inside financial entities, and the register of information sits at the centre of it. Under Article 28, every financial entity shall maintain and update a register of information covering all contractual arrangements on the use of ICT services provided by ICT third-party service providers. The register shall distinguish arrangements that support critical or important functions, shall be made available to the competent authority in full or in specified sections on request, and shall be reported at least yearly. In early 2025, financial entities across the Union submitted their first registers to supervisors, and the exercise proved demanding: it requires mapping every ICT contract, every subcontracting chain and every supported function across the institution.
Beyond the register, the regulation prescribes the substance of ICT contracts. Article 30 requires contractual arrangements to include, among other elements, a clear description of the services, service level targets, provisions on data location and processing, access and audit rights for the financial entity and its supervisors, incident assistance obligations, and termination rights. Arrangements supporting critical or important functions carry additional requirements, including defined exit strategies so the entity can withdraw from a provider without disrupting its services or breaching regulatory obligations.
Subcontracting receives specific attention: entities shall assess whether and how subcontracting of ICT services supporting critical or important functions may be permitted, and the chain of subcontractors shall be visible in the register. Concentration risk completes the assessment: before entering an arrangement, an entity shall weigh whether it is becoming dependent on a provider that is not easily substitutable. For the professional who owns this workload, the Lead Manager training route maps directly onto these obligations.
Relationship with ISO 22301, ISO/IEC 27001 and the NIS 2 Directive
A recurring question in DORA training is whether an existing ISO certification satisfies the regulation. The answer is no, and the distinction is structural. DORA is binding law; ISO standards are voluntary. Certification to a standard demonstrates conformity with that standard, and no certificate discharges a DORA obligation. The standards remain relevant.
ISO 22301 specifies requirements for a business continuity management system. An entity certified to it will already have impact analyses, continuity strategies and tested recovery plans, valuable groundwork for DORA's response and recovery requirements. But DORA adds mandatory, financial-sector-specific obligations the standard does not contain: harmonized incident classification and reporting to supervisors, threat-led penetration testing for designated entities, and the register of information.
ISO/IEC 27001 specifies an information security management system and overlaps substantially with DORA's Chapter II controls on identification, protection and detection. Again, the regulation extends further, into supervisory incident reporting, resilience testing and the oversight of ICT providers, and the management body's personal accountability under DORA has no equivalent in the standard.
The NIS 2 Directive is the EU's horizontal cybersecurity framework. As a directive, it required national transposition, and it covers a far wider range of sectors. For financial entities, DORA operates as lex specialis: where DORA's requirements apply, they take precedence over the corresponding NIS 2 provisions. NIS 2 remains relevant for organizations and activities outside DORA's scope.
Existing ISO management systems shorten the path to DORA compliance considerably, but a gap analysis against the regulation itself, as read on EUR-Lex, remains unavoidable. DORA credentials for individuals, such as those PECB issues, equip professionals to perform that analysis. Standards Academy teaches that analysis with the management body's accountability, under DORA and under ISO 37000, as its starting point.
Frequently asked questions
What are the five pillars of DORA?
The five pillars are: ICT risk management, ICT-related incident classification and reporting, digital operational resilience testing, ICT third-party risk management, and information-sharing arrangements. Together they form a connected discipline where governance feeds testing, testing informs incident response, and third-party oversight runs through all areas.
Which organizations does DORA apply to?
Article 2 lists the in-scope financial entities, including credit institutions, payment and e-money institutions, investment firms, insurers and reinsurers, crypto-asset service providers, trading venues, fund managers and others. ICT third-party service providers are also affected, and those designated as critical fall under direct Union-level oversight.
Does ISO 22301 or ISO/IEC 27001 certification satisfy DORA?
No. DORA is binding law, while ISO standards are voluntary. Certification to ISO/IEC 27001 or ISO 22301 can support compliance by providing established security and continuity management systems, but it does not discharge any DORA obligation. A gap analysis against the regulation's actual text remains necessary.
Is there a DORA certification for organizations?
No body certifies an organization to DORA, because the regulation is law and no certifiable standard exists for it. Compliance is assessed by competent supervisory authorities. PECB DORA credentials attest personal knowledge: they confirm that an individual understands the regulation and can contribute to implementing its requirements within a financial entity.
Which credential suits a compliance officer in a bank or insurer?
The PECB Certified DORA Lead Manager credential suits professionals responsible for establishing, implementing and managing a DORA-aligned ICT risk management framework, which describes most compliance ownership roles. The PECB Certified DORA Foundation credential suits board members, auditors and team members who need grounded knowledge without framework ownership.
What is the register of information?
Under Article 28, every financial entity shall maintain a register of information recording all contractual arrangements for ICT services provided by third-party providers, distinguishing those supporting critical or important functions. The register shall be kept current, reported to the competent authority at least yearly and made available on request.
References
International Organization for Standardization (2021) ISO 37000:2021 Governance of organizations. Guidance. Geneva: ISO. Available at: https://www.iso.org/standard/65036.html (Accessed: 23 October 2026).
Regulation (EU) 2022/2554 of the European Parliament and of the Council of 14 December 2022 on digital operational resilience for the financial sector (Digital Operational Resilience Act) 2022. Available at: https://eur-lex.europa.eu/eli/reg/2022/2554/oj/eng (Accessed: 23 October 2026).
