eu-dora-compliance

name	eu-dora-compliance
description	Implement DORA Regulation (2022/2554) digital operational resilience for financial entities — ICT risk management, incident reporting, resilience testing, third-party risk.
version	1.0.0
last-updated	2026-04-17
model_tested	claude-sonnet-4-6
category	compliance
platforms	["claude-code","codex","gemini-cli","cursor","copilot","windsurf","cline"]
language	en
geo_relevance	["eu"]
priority	critical
dependencies	{"mcp":[],"skills":["eu-regulatory-router"],"apis":[],"data":[]}
update_sources	[{"url":"https://eur-lex.europa.eu/eli/reg/2022/2554/oj","check_frequency":"quarterly","last_checked":"2026-04-17"}]
license	MIT

EU DORA Compliance (Digital Operational Resilience Act)

DISCLAIMER: This skill provides guidance only. It does not constitute legal or financial advice. Always verify with qualified professionals.

When to Use

• Building software for financial institutions in the EU
• Assessing ICT risk management for fintech
• Setting up ICT incident reporting for financial entities
• Designing resilience testing programs
• Managing third-party ICT service provider relationships

Scope — Who Is Affected?

DORA applies to virtually all EU financial entities:

Category	Entities
Banking	Credit institutions, payment institutions, e-money institutions
Investment	Investment firms, trading venues, central securities depositories
Insurance	Insurance/reinsurance undertakings, intermediaries
Pension	IORPs (Institutions for Occupational Retirement Provision)
Crypto	Crypto-asset service providers (MiCA-regulated)
Infrastructure	CCPs, trade repositories, securitization repositories
Other	Credit rating agencies, crowdfunding providers, data reporting services
ICT providers	Third-party ICT service providers to the above (critical designation)

5 Pillars of DORA

Pillar 1: ICT Risk Management (Articles 5-16)

Establish an ICT risk management framework:

• Identify all ICT assets, risks, dependencies
• Protect through security policies, access controls, encryption
• Detect anomalies and incidents via continuous monitoring
• Respond with incident response and crisis communication plans
• Recover with backup policies, restoration procedures, lessons learned

Pillar 2: ICT Incident Reporting (Articles 17-23)

Classify and report major ICT-related incidents:

Criterion	Threshold for Major
Clients affected	> 10% of clients or significant clients
Duration	> 2 hours for critical services
Geographic spread	> 2 member states
Data loss	Integrity, confidentiality, or availability compromised
Economic impact	Material financial loss
Criticality of services	Core banking, payment processing, trading

Reporting timeline:

• Initial notification: within 4 hours of classification as major
• Intermediate report: within 72 hours
• Final report: within 1 month

Pillar 3: Digital Operational Resilience Testing (Articles 24-27)

Test Type	Frequency	Who
Vulnerability assessments	At least annually	All entities
Network security testing	At least annually	All entities
Scenario-based testing	At least annually	All entities
Threat-Led Penetration Testing (TLPT)	At least every 3 years	Significant entities only

TLPT must be conducted by qualified external testers following the TIBER-EU framework.

Pillar 4: Third-Party ICT Risk (Articles 28-44)

For all ICT third-party service providers:

• Maintain a register of all ICT service agreements
• Conduct pre-contract due diligence
• Include mandatory contractual clauses (audit rights, exit strategies, data location)
• Monitor ongoing compliance
• Have exit plans for critical providers

Critical ICT third-party providers (designated by ESAs) face direct EU oversight.

Pillar 5: Information Sharing (Article 45)

Financial entities may participate in voluntary information-sharing arrangements on:

• Cyber threat intelligence
• Indicators of compromise
• Tactics, techniques, and procedures (TTPs)
• Security alerts and configuration tools

Key Date

• 17 January 2025: DORA fully applicable

What This Skill Does NOT Do

• Does not conduct penetration testing or TLPT
• Does not configure ICT security tools
• Does not manage third-party provider contracts
• Does not replace compliance officer or legal counsel