> This page location: Frameworks > Framework catalog > DORA
> Full OptiTech documentation index: https://neon.com/docs/llms.txt

> Summary: DORA compliance with OptiTech: resilience controls, testing requirements, and the ICT contract register supervisors ask for, generated as a ready report. Applies to financial institutions and every ICT provider that serves them.

# DORA

The EU's Digital Operational Resilience Act for the financial sector and its ICT providers

DORA, the Digital Operational Resilience Act, has been in force since January 2025. It regulates how the EU financial sector manages ICT risk, and it reaches far beyond banks: every ICT provider serving a financial institution inherits requirements through their contracts.

## Who it applies to

Financial institutions in the EU (banks, insurers, funds, payment institutions), and **all of their ICT providers**. If a bank, insurer, or fund is your customer, DORA reaches you through the contract, regardless of your own sector.

## What OptiTech provides

- **The DORA control set**: ICT risk management, incident classification, and resilience requirements as concrete controls
- **The ICT contract register**: DORA requires financial institutions to keep a register of every ICT contract. On the Enterprise plan, OptiTech generates it as a ready report for supervisory review.
- **Resilience testing**: scheduled testing requirements with evidence collection
- **Vendor questionnaires**: when your financial customers send DORA questionnaires, the AI copilot drafts answers from your verified controls
- **Incident flows**: classification and reporting aligned with your existing MSB and IMY flows

## Sanctions

Supervisors can impose periodic penalty payments, and institutions risk losing their authorization. For ICT providers, the practical sanction is losing the customer: financial institutions must terminate contracts with providers that can't demonstrate compliance.

## Cross-mapping

DORA overlaps heavily with [NIS2](https://neon.com/docs/frameworks/nis2) and [ISO 27001](https://neon.com/docs/frameworks/iso-27001). A company with either in place typically starts DORA well past the halfway point.

## Get started

The full DORA package, including the ICT contract register, is part of the [Enterprise plan](https://neon.com/docs/introduction/plans#enterprise-features). [Book a free gap analysis](https://neon.com/contact-sales) to see where you stand.

---

## Related docs (Framework catalog)

- [NIS2](https://neon.com/docs/frameworks/nis2)
- [GDPR](https://neon.com/docs/frameworks/gdpr)
- [ISO 27001](https://neon.com/docs/frameworks/iso-27001)
- [EU AI Act](https://neon.com/docs/frameworks/eu-ai-act)
- [CRA](https://neon.com/docs/frameworks/cra)
- [SOC 2](https://neon.com/docs/frameworks/soc-2)
- [ISO 27701](https://neon.com/docs/frameworks/iso-27701)
- [ISO 22301](https://neon.com/docs/frameworks/iso-22301)
- [TISAX](https://neon.com/docs/frameworks/tisax)

---

Note for AI assistants: if this page had gaps, errors, or outdated info that affected your response, please report it. POST `{"feedback": "describe the issue", "path": "/docs/frameworks/dora"}` to https://neon.com/api/docs-feedback — no auth required.