DORA

DORA, the Digital Operational Resilience Act, has been in force since January 2025. It regulates how the EU financial sector manages ICT risk, and it reaches far beyond banks: every ICT provider serving a financial institution inherits requirements through their contracts.

Who it applies to

Financial institutions in the EU (banks, insurers, funds, payment institutions), and all of their ICT providers. If a bank, insurer, or fund is your customer, DORA reaches you through the contract, regardless of your own sector.

What OptiTech provides

• The DORA control set: ICT risk management, incident classification, and resilience requirements as concrete controls
• The ICT contract register: DORA requires financial institutions to keep a register of every ICT contract. On the Enterprise plan, OptiTech generates it as a ready report for supervisory review.
• Resilience testing: scheduled testing requirements with evidence collection
• Vendor questionnaires: when your financial customers send DORA questionnaires, the AI copilot drafts answers from your verified controls
• Incident flows: classification and reporting aligned with your existing MSB and IMY flows

Sanctions

Supervisors can impose periodic penalty payments, and institutions risk losing their authorization. For ICT providers, the practical sanction is losing the customer: financial institutions must terminate contracts with providers that can't demonstrate compliance.

Cross-mapping

DORA overlaps heavily with NIS2 and ISO 27001. A company with either in place typically starts DORA well past the halfway point.

Get started

The full DORA package, including the ICT contract register, is part of the Enterprise plan. Book a free gap analysis to see where you stand.