DORA
with ComplyEncrypt
The Digital Operational Resilience Act (Regulation (EU) 2022/2554) is an EU regulation that has applied since 17 January 2025. It sets uniform requirements for how banks, insurers, investment firms, payment institutions and other financial entities manage ICT risk, and brings critical ICT third-party providers under an EU oversight framework.
Not available to buy yet. No launch date or price has been announced.
Who this is for
EU financial entities and the ICT third-party providers that serve them
Resilience is now a supervisory question, not only an IT one. Financial entities must show that their management body owns ICT risk, that incidents are classified and reported on time, and that every ICT supplier arrangement is registered and governed. Their technology providers increasingly face the same questions in due diligence and contract reviews.
The requirements
What DORA asks of your organization
ICT risk management
Maintain a documented ICT risk-management framework, approved and overseen by the management body, covering protection, detection, response and recovery.
Incidents and resilience testing
Classify ICT-related incidents, report major incidents to the competent authority and run a proportionate digital operational resilience testing programme.
ICT third-party risk
Keep a register of information on ICT third-party arrangements, assess concentration risk and include the required provisions in contracts.
The planned ComplyEncrypt pathway
A structured approach to digital operational resilience
The planned ComplyEncrypt DORA pathway is intended to support DORA through specialized resilience workflows, awareness materials for management and staff, and automated creation of documentation such as the ICT risk framework, incident-classification procedures and the third-party register. It is on the roadmap and not available to buy yet; your interest helps prioritize it.
Intended documentation scope
- ICT risk-management framework and policies
- Incident classification and reporting procedures
- Resilience testing plans and results
- Register of ICT third-party arrangements
Your team remains accountable
The roadmap describes intended functionality, not a currently available module. Documents must reflect your real processes. Your team implements controls, verifies evidence and manages ongoing obligations.
DORA is an EU regulation. Software does not establish legal compliance; confirm how it applies to your entity with your competent authority or qualified legal advisers.
On the roadmap
Interested in buying DORA?
Tell us about your organization and purchase interest. This is an enquiry, not an order, payment or reservation.
Related frameworks
See the product in action.
A 2-minute walkthrough of what you get the moment you buy a framework.