DORA - articles on digital operational resilience in the financial sector

The Digital Operational Resilience Act (DORA) requires financial entities to manage ICT risk, report major ICT-related incidents, test their digital operational resilience regularly and oversee their ICT third-party service providers. These requirements pass down the supply chain to software houses, cloud providers and companies that maintain systems, whose contracts must include the provisions set out in Article 30 of the regulation.

Our article on penetration testing vs TLPT explains the two levels of testing under DORA: the digital operational resilience testing programme under Arts. 24-25, which almost every financial entity has to run, and threat-led penetration testing (TLPT) under Arts. 26-27, which is carried out only by entities designated by the supervisory authority - in Poland, the KNF. It also covers how TLPT works, how to prepare for it before the authority's decision arrives and how to read proposals from TLPT providers.

We write for risk, security and IT teams at financial institutions, and for suppliers who want to know what their financial-sector clients will expect of them.

We take our facts from the text of the regulation, the regulatory technical standards and KNF communications, always with the date of the legal status. Our articles are for information only and are no substitute for legal advice.

How we help financial institutions: DORA compliance, TLPT preparation and ICT risk assessment.