DORA has become part of your daily work. We make it lighter.

DORA is Regulation (EU) 2022/2554. It entered into force on 16 January 2023 and has applied since 17 January 2025. It harmonises digital operational resilience requirements for around 20 types of financial entities in the EU, from banks and insurers to payment institutions and crypto-asset service providers, and brings ICT third-party providers directly into scope.

The goal: the European financial sector should be able to detect, manage and recover from severe digital disruption without putting the stability of the financial system at risk.

• ICT risk management: a documented framework to identify, assess, manage and monitor ICT risk.
• Incident management and reporting: major ICT incidents are classified and reported to the competent authority within the deadlines.
• Digital resilience testing: regular testing, up to threat-led penetration testing (TLPT) for significant institutions.
• ICT third-party risk management: including the register of information, minimum contract content, concentration risk and exit strategies.
• Information sharing: voluntary exchange of cyber threat intelligence between financial entities.

On 18 November 2025, the European supervisory authorities EBA, ESMA and EIOPA designated 19 ICT third-party providers as critical (CTPPs) for the first time, from hyperscalers and network and data centre operators to specialised providers of financial data and services. Since 2026, these providers have been under direct ESA oversight with Lead Overseers and Joint Examination Teams.

Important for financial entities: operational responsibility stays with you. If you use a CTPP, that dependency needs to be reflected in your own register and your concentration risk assessment, and the insights from ESA oversight need to flow into your own ICT risk management. If a critical provider fails to act on supervisory recommendations, national authorities can, as a last resort, require financial entities to suspend or terminate use of its services.

The register of information documents all contractual arrangements with ICT third-party providers, specifically flagging services that support critical or important functions. It is transmitted to the ESAs every year via the national supervisor.

From the first submission round, supervisors flagged typical weaknesses: incomplete registers (think shadow IT), missing exit plans, and contracts still lagging behind the minimum content of the technical standards. For the ongoing rounds, data quality is the deciding factor. A tool-supported register linked to contracts, risks and functions cuts errors and effort considerably.

Once an incident is classified as major, the initial notification is due within four hours, and no later than 24 hours after detection. It is followed by an intermediate report no later than 72 hours after the initial notification and a final report, including root cause analysis, no later than one month after the last intermediate report. The deadlines are tight, which is why a rehearsed, tool-supported reporting process with clear roles is decisive. Practice confirms it: since DORA took effect, several hundred major ICT incidents have been reported in Germany alone, a large share of them linked to external providers.

DORA is an EU regulation, but its effects reach beyond the EU. Swiss financial companies with subsidiaries or business activity in the EU are affected, and so are Swiss ICT providers serving EU financial entities: their clients demand DORA-compliant contracts, the ability to provide evidence, and cooperation on the register of information. Swiss supervisory practice is also increasingly aligning with comparable operational resilience principles. Whoever implements the DORA logic today is well positioned in both markets.

NIS2 is a directive with a broad, cross-sector scope covering essential and important entities. DORA is a regulation that applies specifically and directly to the financial sector. For financial entities, DORA takes precedence over NIS2 as the sector-specific regime. Many organisations still need to keep both frameworks in view, for example in groups with financial and non-financial companies. The SwissGRC® Platform maps both frameworks in one platform, so evidence only has to be produced once.

The SwissGRC® Platform covers the DORA requirements as one coherent whole: a DORA compliance check with measure tracking, ICT risk management and ISMS, the register of information under DORA, end-to-end incident management with a reporting process, business continuity management, and third-party risk management including exit strategies and CTPP dependencies.

As a scalable solution it grows with you: start with the DORA core topics and extend your GRC processes step by step to further areas. Optionally with data residency in Switzerland, and supported by our team, which knows the regulated DACH market from years of hands-on work.