Reading time: 8 minutes

What is the Digital Operational Resilience Act (DORA)?

The Digital Operational Resilience Act (DORA) is EU Regulation (EU) 2022/2554 and has been fully applicable since 17 January 2025. It requires financial entities and their critical ICT service providers to systematically build and demonstrate resilience against cyberattacks and ICT disruptions. For the first time, DORA harmonizes ICT risk management requirements across the EU financial sector and replaces national frameworks such as BAIT, VAIT and KAIT as the primary benchmark.

The regulation applies directly in all EU Member States without requiring national transposition legislation. In Germany, BaFin acts as the central reporting hub for ICT-related incidents and has actively conducted special audits under Section 44 of the German Banking Act (KWG) to assess DORA implementation since 2025.

DORA complements other European cybersecurity frameworks such as the NIS2 Directive and the Cyber Resilience Act, while placing a particular focus on ICT risk management, resilience testing and the secure operation of digital financial services.

DORA applies to financial entities and critical ICT service providers delivering digital services to the financial sector.

DORA applies to financial entities and critical ICT service providers delivering digital services to the financial sector.

For more than 15 years, Greenbone has helped organizations achieve the highest possible security standards. With OPENVAS, we provide market-leading vulnerability detection combined with full data sovereignty. OPENVAS SECURITY INTELLIGENCE and OPENVAS SCAN support financial organizations in meeting DORA requirements.

Which organizations are affected by DORA?

DORA applies to more than 22,000 financial entities and ICT service providers across the European Union. The regulation follows the principle of proportionality: smaller institutions are subject to a simplified ICT risk management framework, while significant institutions such as major banks and systemically important insurers must meet more stringent requirements, including mandatory Threat-Led Penetration Testing (TLPT).

Financial entities

Credit institutions, insurance companies, investment firms, payment service providers, crypto-asset service providers and other financial market participants operating within the EU.

Critical ICT third-party providers

Cloud providers, data centers, software vendors and other ICT service providers delivering essential services to regulated financial entities.

Additional supply chain stakeholders

Organizations that provide ICT services, consulting or technology components to the financial sector and form part of the regulated supply chain.
DORA affects financial entities such as banks, insurers and payment service providers, as well as critical ICT service providers across the digital supply chain.

DORA affects financial entities such as banks, insurers and payment service providers, as well as critical ICT service providers across the digital supply chain.

The Five Pillars of DORA Requirements

DORA structures its requirements into five key areas. Financial entities must demonstrate compliance with all five pillars. Areas where vulnerability management plays a direct role are highlighted below.

DORA structures digital resilience requirements into five pillars that together establish a comprehensive ICT risk management framework.

DORA structures digital resilience requirements into five pillars that together establish a comprehensive ICT risk management framework.

Pillar 1 · Articles 5 to 16
ICT Risk Management
  • Comprehensive inventory and classification of all ICT assets and dependencies
  • Regular vulnerability assessments and threat evaluations (Article 9)
  • Implementation of a comprehensive ICT security strategy with appropriate safeguards
  • Development of incident response and recovery plans for ICT-related incidents
  • Integration of ICT risk management into overall corporate governance
Pillar 2 · Articles 17 to 23
ICT Incident Management and Reporting
  • Establishment of standardized processes for detecting, classifying and handling ICT-related incidents
  • Initial notification of major incidents to BaFin within four hours of detection
  • Intermediate report within 72 hours and final report within one month
  • Maintenance of an incident register with complete documentation of all reported events
Pillar 3 · Articles 24 to 27
Digital Operational Resilience Testing
  • Regular vulnerability scans and network-based security assessments of all ICT systems
  • Scenario-based testing to evaluate preparedness for cyberattacks and system outages
  • For significant institutions: Threat-Led Penetration Tests (TLPT) at least every three years in accordance with the TIBER-EU framework
  • Comprehensive documentation of test results and verified remediation of identified vulnerabilities
Pillar 4 · Articles 28 to 44
ICT Third-Party Risk Management
  • Maintain a complete register of all contractual ICT third-party relationships (Register of Information)
  • Continuous monitoring of the security posture of critical ICT third-party providers, including newly disclosed CVEs affecting deployed components
  • Due diligence when selecting new providers, including security requirements and concentration risk assessments
  • Exit strategies in the event of contract termination or provider failure
Pillar 5 · Articles 45 to 49
Information Sharing
  • Voluntary participation in information-sharing arrangements covering cyber threats and vulnerabilities
  • Reporting relevant threat intelligence to other financial institutions and competent authorities
  • Using shared threat intelligence to improve internal detection and response capabilities

Timeline and Penalties

DORA has been fully applicable since 17 January 2025. BaFin is actively reviewing implementation efforts: by the end of 2025, more than 600 ICT-related incidents had already been reported and several special audits had been initiated. From 2026 onwards, supervisory authorities increasingly expect data-driven evidence of operational resilience rather than policy documentation alone.

DORA has been fully applicable since January 2025. Supervisory authorities increasingly expect reliable evidence of digital resilience.

DORA has been fully applicable since January 2025. Supervisory authorities increasingly expect reliable evidence of digital resilience.

January 2023
DORA enters into force as an EU regulation. The two-year implementation period begins.
January 2025
DORA becomes fully applicable. All requirements relating to ICT risk management, incident reporting, resilience testing and third-party risk management must be fulfilled.
From 2026
Supervisory authorities require data-driven evidence of resilience. The Register of Information must be available for inspection by regulators. TLPT cycles for significant institutions are underway.
From 2027
The simplified ICT risk management framework under Article 16 applies to additional categories of institutions, including certain financial holding companies.
Penalties for Non-Compliance: Organizations that fail to comply may face fines of up to €10 million or 5 percent of their global annual turnover. For critical ICT third-party providers, penalties can reach up to €5 million or 2 percent of worldwide annual turnover. In addition, organizations may face reputational damage and operational restrictions imposed by supervisory authorities.

How Greenbone Supports DORA Compliance

Vulnerability management is at the core of DORA’s ICT risk management and resilience testing requirements. Greenbone directly supports Articles 9, 10 and 28 with a proven ISO-certified scanning infrastructure and audit-ready reporting.

Continuous Scanning

OPENVAS SCAN identifies vulnerabilities across networks, endpoints and cloud environments. The Enterprise Feed is updated daily and includes 200,000+ security tests with industry-leading CVE coverage. Continuous scanning helps organizations detect and remediate risks early while supporting compliance with Articles 9 and 10.

Risk-Based Prioritization

OPENVAS SECURITY INTELLIGENCE delivers contextualized risk assessments based on CVSS scores and current threat intelligence. This enables your team to focus first on the issues that pose the greatest risk. It also supports monitoring of ICT third-party components and supply chain risks in line with Article 28.

Audit-Ready Documentation

All scan results, remediation records and historical trends are stored in an audit-proof format and can be exported at any time. This provides a solid foundation for internal audits, BaFin requests and regulatory reviews. As an ISO/IEC 27001:2022 certified company headquartered in Germany, we ensure complete data sovereignty.
Continuous vulnerability management supports key DORA requirements, including risk management, resilience testing and audit-ready evidence.

Continuous vulnerability management supports key DORA requirements, including risk management, resilience testing and audit-ready evidence.

Frequently Asked Questions (FAQ) About the Digital Operational Resilience Act

The Digital Operational Resilience Act (DORA) is EU Regulation (EU) 2022/2554 and has been fully applicable since 17 January 2025. It requires more than 22,000 financial entities and critical ICT third-party providers across the EU to systematically build and demonstrate resilience against cyberattacks and ICT disruptions. This includes banks, insurance companies, investment firms, payment service providers, crypto-asset service providers and their ICT suppliers.

Yes. DORA explicitly covers critical ICT third-party providers, not just financial institutions themselves. If your organization operates systems, software or services for banks, insurers or investment firms, you are likely within DORA’s scope. The designation as a critical ICT third-party provider is determined by supervisory authorities.

No. DORA requires continuous vulnerability assessments rather than periodic spot checks. Threat-Led Penetration Tests (TLPTs) are an additional requirement for significant institutions and must be conducted at least every three years in accordance with the TIBER-EU framework. However, they do not replace ongoing vulnerability management, which is necessary to satisfy the baseline requirements set out in Articles 9 and 10.

NIS2 is a broad cybersecurity directive for critical sectors and must be transposed into national law. DORA is a directly applicable regulation focused exclusively on the financial sector and imposes far more detailed requirements for ICT risk management, incident reporting, resilience testing and third-party risk oversight. For financial organizations that fall under both frameworks, DORA takes precedence within its specific scope.

Supervisory authorities may impose fines of up to €10 million or 5 percent of global annual turnover. For critical ICT third-party providers, the maximum penalty is €5 million or 2 percent of worldwide annual turnover. Additional consequences may include operational restrictions and reputational damage. BaFin has already initiated active special audits since 2025.

Deployment is typically completed within a matter of hours. OPENVAS SCAN supports standard network topologies, segmented environments and hybrid cloud architectures. Greenbone offers both on-premises and cloud-based deployment options, each providing full data sovereignty and independence from US-based cloud infrastructures.

The Cyber Resilience Act applies to manufacturers, importers and distributors of digital products across industries. DORA is a sector-specific regulation focused exclusively on the financial sector and governs the operation and risk management of ICT systems. The two frameworks complement one another: financial organizations that also develop or market digital products may fall within the scope of both regulations. → Learn more about the Cyber Resilience Act.

Is Your Organization Ready for DORA?

DORA has been in force since January 2025, and BaFin is actively reviewing implementation efforts. Talk to our experts today and discover how OPENVAS SCAN and OPENVAS SECURITY INTELLIGENCE can strengthen your DORA vulnerability management program, whether deployed on premises or in the cloud.