Compliance · DORA
DORA compliance: operational resilience, testing and ICT third-party risk
By Steven Carrier Updated on
Up to date as of . DORA (Regulation (EU) 2022/2554) has applied since 17 January 2025.
DORA requires the European financial sector to withstand ICT incidents, including those originating from its providers. It sets the framework for ICT risk management, incident reporting, resilience testing and control of third-party risk. BEAROPS helps you prepare, document and demonstrate your compliance, in particular on the resilience testing required by Articles 24 and 25.
- Resilience testing (Art. 24-25)
- Compliance support, not a guarantee
- French software vendor
Which entities are in scope of DORA?
DORA applies to a wide range of financial entities: banks, insurers, asset management companies, payment service providers, investment firms and others. It also concerns, indirectly, their ICT service providers, some of which, as critical providers, are subject to direct oversight. The exact scope depends on the entity’s status.
What are the five pillars of DORA?
| Pillar | What it requires |
|---|---|
| ICT risk management | A framework for governing and controlling ICT risk |
| Incident management | Classification and reporting of major ICT-related incidents |
| Resilience testing | A programme of regular testing of critical systems (Art. 24-25) |
| ICT third-party risk | Control of providers, register of information on contractual arrangements |
| Information sharing | Voluntary exchange of cyber threat information and intelligence |
What does DORA require for resilience testing?
Articles 24 and 25 require a programme of regular testing (vulnerability assessments, scenario-based tests, penetration tests ), at least yearly for systems supporting critical functions. Our penetration tests and Red Team exercises fit into your digital operational resilience testing programme under Articles 24 and 25 of DORA. Beareye industrialises continuous assessments and remediation tracking.
What does DORA require for your ICT providers?
DORA requires control of the risk arising from ICT service providers and the maintenance of a register of information on contractual arrangements. In practice, you must know your critical providers, assess their security and document each relationship. Bearlink combines this documentary compliance with native supplier cyber rating (see TPRM ).
BEAROPS is itself an ICT provider: read our sovereignty and hosting doctrine .
From requirements to actions
| DORA requirement | Expected action | How BEAROPS helps |
|---|---|---|
| ICT risk management | Map and manage risk | Unified view of exposure |
| Resilience testing (Art. 24-25) | Test critical systems regularly | Pentest, Red Team, continuous testing |
| Incident management | Detect and document | Traceability of findings and remediation |
| ICT third-party risk | Assess and register providers | Supplier cyber rating and document tracking (Bearlink) |
| Evidence of compliance | Demonstrate implementation | Evidence mapped to requirements |
Manage ICT risk continuously with the CTEM approach of Beareye .
Are DORA registers of information reliable?
In the 2024 dry run led by the European Supervisory Authorities, only 6.5% of the registers of information analysed passed all data quality checks. Almost 1,000 financial entities had submitted their register. This result concerns the quality of the registers, not overall DORA compliance: the quality of the evidence is a checkpoint in its own right.
External benchmark, not BEAROPS data: European Supervisory Authorities (EBA, ESMA, EIOPA), press release of 17 December 2024 on the register of information dry run.
Sources and references
- EBA, ESMA and EIOPA, press release of 17 December 2024 on the DORA register of information dry run
- Regulation (EU) 2022/2554 (DORA), EUR-Lex
- DORA, European Securities and Markets Authority (ESMA)
- Operational resilience, European Banking Authority (EBA)
- DORA, European Insurance and Occupational Pensions Authority (EIOPA)
Sources consulted on . Report an error: contact+site@bearops.fr
Frequently asked questions
Since when has DORA applied?
DORA (Regulation (EU) 2022/2554) has applied since 17 January 2025. As a European regulation, it applies directly, without national transposition, to the financial entities in scope and, indirectly, to their ICT providers.
Is an annual pentest campaign enough for DORA?
Penetration tests are part of the testing programme under Articles 24-25, but DORA expects a broader approach: vulnerability assessments, scenario-based tests, continuous monitoring. A platform such as Beareye helps industrialise these assessments and track the related remediation.
How does DORA address the risk from my providers?
DORA requires control of the risk arising from ICT providers and a register of information on contractual arrangements. You must know, assess and document your critical providers. Bearlink combines this documentary compliance with native cyber rating.
Let’s assess your DORA coverage
A BEAROPS expert helps you position your coverage across the five pillars, scope your testing programme and structure your evidence.