Understanding DORA: How to achieve digital resilience in the financial sector

Since January 17, 2025, the Digital Operational Resilience Act (DORA) has been binding for nearly all supervised financial entities in the EU. It requires banks, insurers, and payment service providers to consistently manage ICT risks. The goal is to strengthen the digital resilience of the entire financial system.

Why DORA replaces national rules

Before DORA, IT security in Germany’s financial sector was governed by several circulars from BaFin, the German Federal Financial Supervisory Authority. Each circular applied to a different type of institution: KAIT covered asset management companies, VAIT covered insurers, and ZAIT covered payment service providers. DORA replaces all three. BAIT, the equivalent for banks, is being phased out gradually and will be fully repealed by December 31, 2026, at the latest.

The key difference from the previous circulars is that: DORA is an EU regulation. It applies directly in every member state and does not require a national implementing act. This eliminates the patchwork of national requirements that financial entities had to follow in each country.

The three core areas of DORA

DORA categorizes its requirements for financial entities into three main areas:

1. ICT risk management, which serves as the overarching core element and defines internal governance structures, control frameworks, and responsibilities.
2. Cybersecurity, which includes requirements for incident detection, classification, and reporting.
3. Digital operational resilience, verified through regular testing, such as vulnerability scans and load tests.

Senior management carries more responsibility than before. DORA explicitly assigns responsibility for ICT risk management strategy and resources to the company’s management body.

Why DORA is not a checklist

Unlike ISO standards, DORA does not prescribe specific technical standards. The reason is technology neutrality, a principle also found in the GDPR. Financial entities vary widely in size, business model, and technical setup. Overly specific rules would require too little of some entities and too much of others.

Instead, companies assess their own risk situation and define appropriate measures. Recognized frameworks can guide this process, such as ISO 27001, Germany’s Federal Office for Information Security’s (BSI) IT-Grundschutz methodology, or clarifying guidance from BaFin. However, this openness presents a challenge. The obligation to provide evidence and documentation is extensive, and many companies underestimate its scope in practice.

ICT third-party risk management: service providers are affected too

One central element of DORA covers both internal IT and relationships with external providers. If you outsource IT services, you must evaluate the risk posed by each third-party provider before signing a contract with them. Then, you must monitor their suitability on an ongoing basis.

This affects more companies than you might expect. Even a provider that offers no financial services, such as HR management software, can fall under DORA requirements indirectly if financial entities use its solution. Article 30 of the DORA regulation sets out additional contractual requirements if a provider supports a critical or important function.

This point alone caused considerable pressure in the market at the end of 2024. Shortly before the January 2025 deadline, many third-party providers received DORA addenda that they had to review and substantiate quickly.

Liability remains a matter of contract

Despite all precautions, if a security incident occurs, liability is first determined by the existing contracts between the financial entity and the provider. The degree of negligence and the applicability of insurance, such as directors and officers (D&O) insurance, are also important considerations. DORA itself does not establish a new liability regime. However, it changes the basis on which due diligence will be measured in the future.

What financial entities can do now

Although the first major implementation wave is complete, DORA remains an ongoing process. Key starting points for the coming months are:

• Review existing supplier contracts regularly for DORA compliance, especially for critical or important outsourced functions.
• Treat internal ICT risk management as a continuous process rather than a one-off project.
• Actively test digital operational resilience instead of only proving it on paper.
• Keep an eye on the parallel implementation of NIS2, as the two frameworks overlap in many companies.

For banks, insurers, and payment service providers, the technical resilience of their online infrastructure is equally important. The financial sector is one of the industries most frequently attacked, as discussed in our article “Difficult Times for Banks Due to DDoS.” Proven, tested resilience against cyberattacks is therefore not only a DORA requirement. It also provides tangible protection for your business.

DORA as an opportunity, not just an obligation

Despite the considerable effort involved, many companies now view DORA positively. Rather than viewing the regulation as a tiresome compliance duty, many financial entities have used its implementation as an opportunity to modernize their security processes. DORA is only the beginning. The next major regulation, NIS2, is already on the way.

Conclusion: resilience is more than a compliance topic

DORA makes it clear that digital resilience in the financial sector is not just an IT issue. It is a task for senior management. Organizations that take the requirements seriously protect themselves and their customers from the consequences of an IT outage.

If you’d like to learn more, you can listen to the full podcast episode with Dr. Thorsten Hennrich here (in German).

At Link11, we help financial entities secure the technical side of this resilience with DDoS protection, WAAP and Secure DNS. Would you like to know how your infrastructure would perform in DORA testing? Get in touch with us.