| name | eu-dora-compliance |
| description | Implement DORA Regulation (2022/2554) digital operational resilience for financial entities — ICT risk management, incident reporting, resilience testing, third-party risk. |
| version | 1.0.0 |
| last-updated | 2026-04-17 |
| model_tested | claude-sonnet-4-6 |
| category | compliance |
| platforms | ["claude-code","codex","gemini-cli","cursor","copilot","windsurf","cline"] |
| language | en |
| geo_relevance | ["eu"] |
| priority | critical |
| dependencies | {"mcp":[],"skills":["eu-regulatory-router"],"apis":[],"data":[]} |
| update_sources | [{"url":"https://eur-lex.europa.eu/eli/reg/2022/2554/oj","check_frequency":"quarterly","last_checked":"2026-04-17"}] |
| license | MIT |
EU DORA Compliance (Digital Operational Resilience Act)
DISCLAIMER: This skill provides guidance only. It does not constitute legal or financial advice. Always verify with qualified professionals.
When to Use
- Building software for financial institutions in the EU
- Assessing ICT risk management for fintech
- Setting up ICT incident reporting for financial entities
- Designing resilience testing programs
- Managing third-party ICT service provider relationships
Scope — Who Is Affected?
DORA applies to virtually all EU financial entities:
| Category | Entities |
|---|
| Banking | Credit institutions, payment institutions, e-money institutions |
| Investment | Investment firms, trading venues, central securities depositories |
| Insurance | Insurance/reinsurance undertakings, intermediaries |
| Pension | IORPs (Institutions for Occupational Retirement Provision) |
| Crypto | Crypto-asset service providers (MiCA-regulated) |
| Infrastructure | CCPs, trade repositories, securitization repositories |
| Other | Credit rating agencies, crowdfunding providers, data reporting services |
| ICT providers | Third-party ICT service providers to the above (critical designation) |
5 Pillars of DORA
Pillar 1: ICT Risk Management (Articles 5-16)
Establish an ICT risk management framework:
- Identify all ICT assets, risks, dependencies
- Protect through security policies, access controls, encryption
- Detect anomalies and incidents via continuous monitoring
- Respond with incident response and crisis communication plans
- Recover with backup policies, restoration procedures, lessons learned
Pillar 2: ICT Incident Reporting (Articles 17-23)
Classify and report major ICT-related incidents:
| Criterion | Threshold for Major |
|---|
| Clients affected | > 10% of clients or significant clients |
| Duration | > 2 hours for critical services |
| Geographic spread | > 2 member states |
| Data loss | Integrity, confidentiality, or availability compromised |
| Economic impact | Material financial loss |
| Criticality of services | Core banking, payment processing, trading |
Reporting timeline:
- Initial notification: within 4 hours of classification as major
- Intermediate report: within 72 hours
- Final report: within 1 month
Pillar 3: Digital Operational Resilience Testing (Articles 24-27)
| Test Type | Frequency | Who |
|---|
| Vulnerability assessments | At least annually | All entities |
| Network security testing | At least annually | All entities |
| Scenario-based testing | At least annually | All entities |
| Threat-Led Penetration Testing (TLPT) | At least every 3 years | Significant entities only |
TLPT must be conducted by qualified external testers following the TIBER-EU framework.
Pillar 4: Third-Party ICT Risk (Articles 28-44)
For all ICT third-party service providers:
- Maintain a register of all ICT service agreements
- Conduct pre-contract due diligence
- Include mandatory contractual clauses (audit rights, exit strategies, data location)
- Monitor ongoing compliance
- Have exit plans for critical providers
Critical ICT third-party providers (designated by ESAs) face direct EU oversight.
Pillar 5: Information Sharing (Article 45)
Financial entities may participate in voluntary information-sharing arrangements on:
- Cyber threat intelligence
- Indicators of compromise
- Tactics, techniques, and procedures (TTPs)
- Security alerts and configuration tools
Key Date
- 17 January 2025: DORA fully applicable
What This Skill Does NOT Do
- Does not conduct penetration testing or TLPT
- Does not configure ICT security tools
- Does not manage third-party provider contracts
- Does not replace compliance officer or legal counsel
