DORA, with your ICT suppliers in view.
DORA makes operational resilience, and the ICT providers behind it, a regulated obligation for EU financial entities. TruOps connects the two.
DORA readiness
Requirements met, by pillar
The same work also counts toward
Mapped coverage, with partial overlaps shown
Each mapping is labeled exact, partial, or inferred, with a source.
The Digital Operational Resilience Act (DORA), Regulation (EU) 2022/2554, has applied since 17 January 2025 to most EU financial entities, including banks, insurers, investment firms, and payment institutions. It sets requirements in five areas: ICT risk management, ICT-related incident reporting, digital operational resilience testing, ICT third-party risk management (including a register of information), and information sharing.
- Instrument
- Regulation (EU) 2022/2554
- Applies from
- 17 January 2025
- Applies to
- EU financial entities and critical ICT third-party providers
- Pillars
- ICT risk, incidents, testing, third parties, and information sharing
The five pillars
| Area | What it requires |
|---|---|
| ICT risk management | A documented framework, with accountability for the management body |
| Incident reporting | Classification of ICT incidents and reporting of major ones to authorities |
| Resilience testing | A testing program, plus threat-led penetration testing for significant entities |
| ICT third-party risk | Contract requirements, exit strategies, and a register of information on ICT providers |
| Information sharing | Voluntary sharing of cyber threat information |
The challenge
The hard part of DORA is knowing every ICT third party: what they do, how concentrated your risk is, and whether their contracts and testing meet the rules.
- The register of information is a report that's disconnected from actual vendor oversight.
- Incident classification and testing evidence live in other teams' tools.
- Critical ICT providers sit in the same TPRM queue as everyone else and get a generic SIG.
What you're probably using today
Almost nobody starts DORA from scratch. You already have a program somewhere, and TruOps picks up from there.
| What you use now | Where it falls short | With TruOps |
|---|---|---|
| Spreadsheets, shared drives, and email | Your program lives in folders named after last year's audit. Owners paste screenshots the week before fieldwork, and nothing is dated, so you can't show what was true last quarter. | Upload those same files. TruOps pre-fills the assessment from them, cites every answer, and keeps technical checks running so you have evidence for the whole period. |
| SOC 2 automation tools | Great for getting certified, with automated tests, a big framework library, and often a trust center. Maturity scoring, custom frameworks, and deeper risk or vendor work can fall outside what they cover. | Keep your automated checks. Use any framework as your anchor, map the rest with partial overlaps clearly marked, and run vendor and risk work in the same place. Start with the policies and reports you already have. |
| Enterprise GRC suites | They can model almost anything, but that flexibility usually runs through implementation partners and admins, so every change turns into a project. | AI reads your existing documents and sets up the program. Your first assessment opens pre-filled with sources, and you make changes by asking in plain language. |
| A register-of-information spreadsheet | It gets filled in for the filing and falls out of date right away. Concentration risk is a guess. | Vendors, tiers, assessments, and findings live in one place, so concentration risk comes straight from the data. |
Third parties are the hardest part
DORA requires a register of information covering contracts with ICT third-party service providers, plus assessments of concentration risk. TruOps keeps vendors, their tiers, assessments, and findings in one place, and flags when too much depends on one provider.
How TruOps helps with DORA
Pick DORA as your anchor, or map it to the framework you already run. TruOps keeps DORA's own structure, down to the individual requirement, and shows coverage per requirement as satisfied, partial, or open, with the evidence behind each.
Upload what you have (prior reports, policies, spreadsheets) and TruOps pre-fills your DORA assessment with cited answers. Connected tools keep technical controls current on the schedule you set, and failed checks become findings with a recommended fix.
How TruOps helps
- Anchor or map
- Use DORA as your anchor or map it to another framework, and your work counts once.
- Pre-filled assessment
- Your DORA assessment opens with the answers your evidence supports already filled, each cited.
- Accurate coverage
- Partial coverage is clearly marked, with the remaining requirements listed.
- Continuous monitoring
- Technical controls checked against your tools, from hourly to quarterly.
- Findings with fixes
- Failed checks become grouped findings with a recommended action.
- Audit-ready snapshots
- Results saved as of their date, with the evidence trail attached.
Questions
When did DORA start to apply?
17 January 2025.
Who does DORA apply to?
Most EU financial entities, including credit institutions, payment and e-money institutions, investment firms, insurers, and crypto-asset service providers, plus oversight of critical ICT third-party providers.
What is the DORA register of information?
A register of all contractual arrangements with ICT third-party service providers, maintained by financial entities and reported to authorities.
How does DORA relate to NIS2?
DORA is finance-specific legislation. Where it applies, it takes precedence over the matching NIS2 obligations.
Do we have to rip out the tools we already use?
No. TruOps connects to your cloud, identity, endpoint, vulnerability, and code tools. Spreadsheets, prior reports, and policies upload into the Data Room. If you're moving from a SOC 2 automation tool or an enterprise GRC suite, you bring over your frameworks, evidence, vendors, and risks.
Can we bring our existing assessments, control lists, and vendor files?
Yes. Upload workbooks, reports, policies, and vendor exports. TruOps turns them into structured questionnaires, controls, and risks, each linked to the file it came from, for you to review.
Does TruOps replace our auditor, QSA, or certification body?
No. Only a licensed auditor, QSA, C3PAO, or accredited certification body can issue the opinion. TruOps keeps your evidence current, sourced, and dated so fieldwork goes quickly.
Related
EU cybersecurity obligations for essential and important entities.
→IndustriesFinancial servicesOverlapping regulations, heavy vendor oversight, and examiners who want proof.
→IndustriesBankingExam-ready programs, third-party oversight, and cyber maturity.
→Use casesVendor risk assessmentsTier, assess, and check vendors without getting buried in questionnaires.
→LearnThird-party risk managementTPRM: managing the risks vendors bring.
→See it run on your own data.
Book 30 minutes with a GRC specialist. Bring a real document, like a SOC 2 report, risk register, or vendor list (redacted is fine), and we'll show TruOps AI working on it.