The Digital Operational Resilience Act (DORA) and its Impact on the Tech Industry

The proposed legislation from the European Commission looks to create EU-wide legislation to protect the operational resilience of the financial services industry.

Learn More

We explore this regulation and its impact on the tech industry.

This act would bring a wide range of ICT companies that supply products and services to the finance industry under the regulatory authority of the EU. This could have a major operational impact on those companies.

Final Countdown to DORA

Prioritize, Plan, and Comply

Read More
Who is Impacted?

Which companies could be impacted by this regulation?

View Infographic

Find out more about technology in the context of industry

Read our Latest Blogs

The Latest Tech News You Need to Know

Read More
Explore our Coverage

The Latest Tech News You Need to Know

Read More
5 Steps to Prepare for DORA

Find out more about technology in the context of industry

Archana Venkatraman

Associate Research Director, Cloud Data Management, IDC Europe

Explore My Research

Maria Adele Di Comite

Research Director, IDC Financial Insights Corporate and Retail Banking

Explore My Research

George Briford

Associate Research Director, IDC Financial Insights

Explore My Research

Ralf Helkenberg

Research Manager, European Privacy and Data Security

Explore My Research

5 Steps to Prepare for DORA

With DORA set to be applied on January 17, 2025, organisations need to get ready. You must ensure that you have the policies and procedures in place to meet the requirements laid out by the act. But how to start preparing? We have compiled a list of steps that financial entities and ICT vendors need to take to get ready for the implementation of DORA.

Financial Entities

1. Awaraness

Ensure the relevant people including the management board, risk management and compliance teams are aware of DORA. Ensure they understand the regulatory requirements that apply.

2. Roles & responsibilities

Identify all the relevant internal stakeholders. Set up a DORA programme involving those stakeholders and assign roles.

3. Gap analysis

Undertake a preliminary self-assessment. A gap analysis will help your organisation assess whether the existing ICT risk management approaches meet the requirements proposed in DORA.

4. Planning

Define a risk-based road map to bridge any compliance gaps identified in your self-assessment and gap analysis

5. Collaboration

Identify and prioritise the relevant partners you need to collaborate with.
ICT Providers

1. Roles & responsibilities

Appoint or introduce the role of compliance or regulatory officer to ensure that someone is managing this area for your business.

2. Know yourself

Undertake a preliminary self-assessment of your current clients to understand if your organisation is a critical provider.

3. Size the impact

Review the draft regulations to understand both the requirements from the DORA provisions (direct impact), and the requirements to be fulfilled under contractual arrangements with a financial entity (indirect impact).

4. Identify

Assess the “critical or important functions” with your product and technology leaders. Highlight areas that qualify as “vulnerabilities” and “ICT third-party risk” under the regulations. Match and prioritise them with your customer base.

5. Collaboration

Plan how you will communicate to your clients how you intend to align with them, to prepare a shared approach to DORA (also a relationship building opportunity).

The Digital Operational Resilience Act (DORA) and its Impact on the Tech Industry

DORA - Contact Us

We explore this regulation and its impact on the tech industry.

Final Countdown to DORA

Who is Impacted?

Find out more about technology in the context of industry

Read our Latest Blogs

Explore our Coverage

5 Steps to Prepare for DORA

Find out more about technology in the context of industry

Archana Venkatraman

Maria Adele Di Comite

George Briford

Ralf Helkenberg

5 Steps to Prepare for DORA

Financial Entities

1. Awaraness

2. Roles & responsibilities

3. Gap analysis

4. Planning

5. Collaboration

ICT Providers

1. Roles & responsibilities

2. Know yourself

3. Size the impact

4. Identify

5. Collaboration

For more information, or to speak with one of our analysts, contact us today.

IDG Environmental Policy

We fulfill this mission by a commitment to:

Leaving?