Practical guide · Financial sector

Implementing DORA

What IT concretely has to deliver, beyond the paperwork

The Digital Operational Resilience Act has applied since January 2025 to banks, insurers, and other financial entities, along with their ICT service providers. Many institutions have written the frameworks, but the IT-side implementation lags: incomplete inventories, tests that would not hold, outdated third-party registers. Here are the building blocks IT actually has to deliver, from FHC+P's project practice in the financial sector. The supervisory assessment belongs to compliance and legal counsel.

1 · Foundation

ICT risk management with a real inventory

›Complete asset inventory: All ICT systems, dependencies, and supported business functions, maintained as a living dataset, not an Excel snapshot. Without an inventory, every risk analysis is guesswork.
›Critical functions mapped: Which systems carry critical or important functions, and what happens if they fail? Protection needs, testing depth, and recovery targets derive from this.
›Backup and recovery proven: Restoration is practised and measured regularly (not just backed up), including documented restore tests for critical systems.

2 · Incidents

Classify incidents and report on time

›Classification logic in the ticket system: The DORA criteria for major ICT incidents are built into the incident process, so classification happens in minutes rather than meetings when it counts.
›Reporting chain with deadlines: Initial, intermediate, and final reports to the supervisor are set up as a workflow with owners and templates, not just a paragraph in a policy.
›Practice instead of hope: At least one annual incident exercise including the reporting path, with documented lessons learned.

3 · Testing resilience

Test what has to hold in an emergency

›Testing programme with a plan: An annual programme of vulnerability scans, scenario and recovery tests for critical systems, prioritised by risk and tracked through to remediation.
›TLPT in view: For designated institutions: threat-led penetration tests (TLPT) every three years, with a realistic scope and clean preparation and follow-up.
›Findings management: Every test result has an owner, a deadline, and a follow-up. A test without tracked remediation is worthless for an audit.

4 · Third parties

Third parties under control

›Information register current: The register of all ICT third-party providers is complete, up to date, and fed from contract and inventory data, it is the basis of every supervisory request.
›Contract clauses updated: Access, audit, and termination rights, security requirements, and subcontractor rules in the ICT contracts, existing contracts included.
›Exit strategies that would actually work: For critical providers a realistic exit plan exists (data return, transitional operations, alternatives), not a boilerplate paragraph.
›Concentration risks assessed: Where do several critical functions depend on the same provider, and what is plan B?

Questions & Answers

FAQ

Have further questions? Feel free to contact us directly via our contact form or by e-mail.

Who does DORA apply to? +

To a broad spectrum of financial entities in the EU, from banks through insurers and investment firms to payment service providers, and indirectly to their ICT service providers. DORA has applied since 17 January 2025 and is enforced by the financial supervisors.

Where does DORA implementation most often fail in practice? +

At the gap between paperwork and operations: frameworks and policies exist, but the asset inventory is incomplete, the information register outdated, restore tests are missing, and incident classification is not built into the ticket system. Exactly these operational building blocks are what we implement.

Does FHC+P also do the supervisory assessment? +

No, we deliver the technical and process implementation: inventories, reporting and testing processes, third-party registers, exit plans, and their anchoring in operations. The supervisory assessment and communication with the supervisor lies with your compliance function, with whom we work closely.