One year after, the Digital Operational Resilience Act (DORA) came into force: Initial lessons learned

One year after the Digital Operational Resilience Act (DORA) entered into force, European financial entities are facing a new reality: DORA compliance is no longer a forward-looking programme, but an operational and strategic requirement embedded into daily activities. Covering more than 22,000 financial entities, the regulation fundamentally reshapes ICT risk management, governance, incident reporting, and third-party oversight.

This white paper offers a clear, experience-driven perspective on how financial institutions are responding to the Digital Operational Resilience Act in practice. It explores how banks and insurers are:

  • structuring their compliance framework,
  • strengthening operational resilience,
  • securing continuity of services,
  • addressing cyber risk,
  • navigating heterogeneous maturity levels,
  • interpreting regulatory requirements,
  • managing cross‑border constraints

Rather than providing a theoretical overview of the regulation, the paper is built on real field experience: insights drawn from Sopra Steria’s missions across Europe, concrete observations, operational challenges, and a forward‑looking vision of what comes next as institutions move from initial compliance toward long‑term resilience.

White Paper Table of Contents

A European perspective on DORA challenges for key financial sector players

  • Tier 1 banks
  • Tier 2 and Tier 3 banks, and neo-banks
  • Insurance companies

Best practices for each DORA pillar to ensure sustained compliance over time

  • Pillar 1: Ensuring strong governance in ICT crisis management
  • Pillar 2: Establishing a robust incident management framework
  • Pillar 3: Implementing a comprehensive digital operational resilience testing programme
  • Pillar 4: Streamlining Third-Party Risk management through technology
  • Ensuring harmonisation of practices across the organisation

What are the consequences in the post-DORA landscape?

A European perspective on DORA challenges for key financial sector players

While DORA applies uniformly across the European Union, its operational impact varies significantly depending on the size, complexity, and maturity of financial entities. This white paper provides a comparative European perspective, highlighting how different segments of the financial sector are experiencing DORA compliance.

Tier 1 banks typically benefit from more mature governance and cybersecurity frameworks, yet face significant challenges in harmonising ICT risk management, incident reporting, and resilience testing across multiple entities and jurisdictions. Managing extensive ICT ecosystems and complex subcontracting chains makes third-party risk management particularly demanding.

Tier 2 and Tier 3 banks, as well as neo-banks, operate under very different constraints. Limited resources, strong reliance on external ICT providers, and lean teams make the implementation of a comprehensive compliance framework more complex. For these institutions, DORA compliance often requires deep structural changes to governance, incident management processes, and resilience testing capabilities.

Insurance companies face another distinct reality. Historically subject to fewer sector-specific ICT regulations than banks, insurers must now rapidly strengthen governance, resilience testing, and third-party oversight often while managing cloud transformation programmes and geographically dispersed operations.

Through concrete European use cases, the white paper highlights how these differences translate into specific operational challenges and identifies practical ways to adapt DORA requirements to diverse organisational contexts.

Dora compliance: the five pillars for sustained operational resilience

Pillar 1: Ensuring Strong Governance in ICT Crisis Management

DORA significantly reinforces governance requirements by placing digital operational resilience under direct executive accountability. Financial entities must establish a clear ICT crisis management framework, define roles and responsibilities, and ensure effective coordination across IT, risk, compliance, and business teams.

Governance models such as the Three Lines of Defence can be leveraged to structure responsibilities, improve decision-making, and strengthen information sharing during crises. Clear communication channels and regular crisis simulations are essential to maintaining continuity of services.

The Business Impact Analysis (BIA) is essential for identifying critical functions and assessing the impact of severe disruptions. It helps prioritise recovery, map key dependencies and define metrics such as RTO and MTD, forming a practical basis for crisis management and resilience planning.

Pillar 2: Establishing a robust incident management framework

Incident reporting remains one of the most operationally sensitive aspects of DORA compliance. Strict notification timelines, complex classification criteria, and heightened regulatory scrutiny require financial entities to industrialise incident management processes.

The white paper explores how organisations are strengthening data quality, automating reporting, and aligning stakeholders to ensure timely, accurate communication with supervisors while limiting operational and reputational impacts from cyber risk events.

Pillar 3: Implementing a Comprehensive Digital Operational Resilience Testing Programme

Resilience testing is a key part of DORA compliance, supporting the ICT risk management framework and helping maintain continuity of critical services.

It includes security and recovery exercises, such as TLPT (Threat Led Penetration Testing), to reflect real-world threat scenarios.
Findings are tracked over time to strengthen controls and drive continuous improvement.

The white paper provides practical insights into structuring a scalable resilience testing framework that supports continuous improvement, regulatory compliance, and operational readiness.

Pillar 4: Streamlining Third-Party Risk Management Through Technology

Third-party risk management is widely regarded as the most complex and time-consuming DORA pillar. Financial entities must maintain detailed ICT supplier registers, strengthen contractual clauses, ensure exit strategies, and continuously monitor critical service providers.

The white paper highlights how technology automation, data platforms, and AI-enabled tools can transform third-party oversight, improve governance, and support digital sovereignty while reducing operational burden.

Pillar 5: Ensuring Harmonisation of Practices Across the Organisation

For multi-entity groups, DORA compliance requires a coordinated model that keeps local accountability while ensuring group-wide consistency.
A federated approach balances central governance with controlled autonomy, supported by shared standards and common tools.

This reduces duplication, improves information sharing, and strengthens operational resilience at scale.

What changes in the post-DORA landscape

In the post-DORA landscape, compliance can no longer rely on manual or ad hoc processes and must evolve into sustainable, scalable operational resilience. DORA helps institutions map ICT dependencies through an exhaustive supplier register, revealing risk concentrations and driving stronger oversight of critical providers, reinforcing digital sovereignty. Market dynamics are also shifting, with ICT providers pursuing consolidation, specialisation, or integration to meet higher compliance and resilience expectations. AI and RegTech solutions are increasingly central to automate data collection, simplify reporting, and enable continuous third-party risk monitoring.

Finally, DORA strengthens executive accountability and will be complemented by new EU initiatives such as the AI Act and the Cyber Resilience Act as threats and technologies evolve.

Download the white paper to gain concrete insights, real-world use cases, and practical guidance to strengthen your organisation’s digital operational resilience.

Fill out the form below to request the full version of the study

Frequently Asked Questions About DORA Compliance

DORA, or the Digital Operational Resilience Act, is a European Union regulation that explicitly concerns EU financial services and aims to maintain cybersecurity resilience.

The DORA law applies to all financial institutions in the EU. This includes traditional financial entities, such as banks, investment firms, and credit institutions, as well as non-traditional entities, including crypto-asset service providers and crowdfunding platforms.

TLPT simulates real-world cyberattacks to assess an institution’s ability to detect, respond to, and recover from severe threats. It is a key component of DORA’s resilience testing requirements and demands advanced preparation and coordination.

The Digital Operational Resilience Act (DORA) is an EU regulation that entered into force on 16 January 2023 and applies as of 17 January 2025.