DORA: From Cybersecurity to Operational Resilience

In the financial world, 2026 marks the end of "compliance by checklist." With the Digital Operational Resilience Act (DORA) now fully enforceable, the European Union has shifted its focus from traditional cybersecurity—preventing unauthorized access—to Operational Resilience: the ability of a financial institution to withstand, respond to, and recover from all types of ICT-related disruptions.

For banks, insurance providers, and investment firms, the message from regulators is clear: It is no longer enough to have a strong perimeter; you must prove you can maintain service continuity even when your primary systems fail.

The Four 2026 Priorities

1. ICT Risk Management: The "Single Pane of Glass"

DORA mandates a comprehensive ICT risk management framework that is reviewed annually. By 2026, firms are expected to have moved beyond static spreadsheets to dynamic Registers of Information.

• Standardization: You must maintain a unified inventory of all ICT assets, mapping them to the "Critical or Important Functions" they support.

• Management Accountability: Responsibility sits with the Board. Executives must now undergo regular ICT security training and are personally accountable for the digital resilience strategy and budget.

2. Major Incident Reporting: The 4-Hour Clock

DORA introduces a highly compressed and standardized reporting regime for major ICT incidents.

• The Deadlines: While the GDPR allows 72 hours, DORA can require an initial notification within 4 hours of determining an incident is "major," and no later than 24 hours from awareness.

• Phased Reporting: Following the initial alert, firms must provide an Intermediate Report as the situation evolves and a Final Report (including a root-cause analysis) within one month.

3. Third-Party Oversight: Managing the Cloud Giants

One of DORA’s most radical changes is the direct oversight of Critical ICT Third-Party Providers (CTPPs), such as major cloud platforms and data center providers.

• Direct ESA Oversight: As of late 2025, the European Supervisory Authorities (ESAs) have designated the first list of CTPPs. These providers are now subject to direct inspections and recommendations from Lead Overseers.

• Contractual Mandates: By 2026, all contracts with ICT providers must include specific clauses regarding audit rights, service level agreements (SLAs), and "Exit Strategies" that allow a financial entity to migrate services without disrupting operations.

4. TLPT: The Live-Fire "Red Team" Test

For "significant" financial entities, standard penetration testing is no longer sufficient. DORA mandates Threat-Led Penetration Testing (TLPT).

• The 3-Year Cycle: Significant firms must conduct a TLPT at least once every three years. This is a realistic, intelligence-led "red team" exercise performed on live production systems.

• Purple Teaming: Unlike traditional tests, DORA emphasizes "Purple Teaming"—a collaborative debrief where defenders (Blue Team) and attackers (Red Team) work together to close the specific gaps discovered during the simulation.

2026 Implementation Checklist

• [ ] Finalize the Information Register: Ensure your list of ICT contractual arrangements is ready for the annual submission window (typically February/March).

• [ ] Update Incident Response Playbooks: Standardize your internal classification of "Major ICT Incidents" to match DORA’s specific thresholds (e.g., geographic spread, data loss, or duration).

• [ ] Audit Your Exit Plans: For every critical third-party provider, do you have a documented, tested plan to move your data and services if they suffer a total failure?

• [ ] Board Training: Schedule the mandatory 2026 ICT risk training session for your senior management body.

← Back to resources