Financial entities
DORA gap analysis
“We assess your current level of compliance against the requirements of the DORA Regulation and identify the priority gaps for your compliance plan.”
DORA Compliance in Spain
Comply with the DORA Regulation (Digital Operational Resilience Act) with specialist advice: gap analysis, ICT risk management, ICT third-party provider requirements, resilience testing and incident reporting for financial entities subject to Regulation (EU) 2022/2554.
Free DORA consultation
We reply in under 24 h
- Initial notification
- 4 hours
- Intermediate report
- 72 hours
- Final report
- 1 month
- DORA Regulation
- Reg. (EU) 2022/2554
Services
DORA compliance services for financial entities
Six practice areas covering the five pillars of the DORA Regulation, with a compliance plan proportionate to your entity’s risk profile.
Gap analysis
DORA gap analysis
Assessment of your current level of compliance against the five pillars of the DORA Regulation: identifying gaps, prioritizing actions and a compliance roadmap proportionate to the entity’s size and risk.
Learn more →
Regulation (EU) 2022/25545 pillarsProportionality
ICT risk
ICT risk management framework
Design and implementation of the ICT risk management framework under DORA Article 6: policies, asset classification, security controls, continuity plan and review by the management body.
Learn more →
DORA Art. 6ICT continuityGovernance
Incidents
ICT-related incident management and reporting
Implementation of the process for classifying, managing and reporting major ICT-related incidents to the Bank of Spain, the CNMV or the DGSFP, in line with DORA deadlines and criteria.
Learn more →
4h / 72h / 1 monthCNMV / Bank of Spain
ICT third parties
ICT provider and contract management
Review and adaptation of contracts with ICT third-party service providers to DORA requirements: mandatory clauses, register of information, CTPP classification and due diligence.
Learn more →
CTPPsSLAs / continuity
TLPT testing
Digital operational resilience testing
Coordination of DORA resilience testing: annual basic testing and TLPT for significant entities under the TIBER-EU framework.
Learn more →
TLPTTIBER-EU
Training
DORA training and awareness
Training programs for boards of directors and for IT, compliance and operations teams on the requirements and obligations of the DORA Regulation.
Learn more →
Senior managementRole-based
The five pillars
DORA in practice: five real obligations
ICT risk management, incident reporting, resilience testing, third-party providers and information sharing: each pillar has its own deadlines, roles and required evidence.
ICT risk management
ICT risk management framework
“We design and implement the ICT risk management framework required by DORA: policies, controls, roles and procedures approved by the management body.”
Third-party providers
Managing critical ICT providers
“We review contracts with ICT providers, identify the critical ones, adapt clauses to DORA requirements and set up the required register of information.”
Incidents and resilience
Incident reporting and TLPT
“We implement procedures for classifying and reporting ICT-related incidents and coordinate the TLPT required by DORA for significant entities.”
Why it matters
Why is DORA compliance urgent?
DORA has applied since January 2025. Entities that have not started their compliance work are exposed to administrative penalties, senior management liability and reputational damage with the supervisor.
A legal obligation since January 2025: the DORA Regulation is directly applicable throughout the EU. Entities that do not comply are exposed to significant administrative penalties and active supervision by the Bank of Spain, the CNMV or the DGSFP.
Broad scope: DORA covers banks, insurers, fund managers, investment firms, payment institutions, crypto-asset service providers (MiCA) and their critical ICT third-party service providers (CTPPs).
ICT supply chain risk: a breach at a cloud or software provider can trigger incidents that the financial entity must report within very tight deadlines (4 hours from classification).
Direct liability
Senior management
DORA makes the management body responsible for approving, overseeing and reviewing the ICT risk framework. Ignorance is no excuse.
Penalties
Up to 2% of turnover
Very serious infringements can lead to penalties of up to 2% of total annual turnover, as well as disqualification of the responsible managers.
Incident with no process
Automatic infringement
Failing to report a major ICT-related incident on time is in itself an infringement of the DORA Regulation and can lead directly to an administrative penalty.
Is your entity ready for DORA?
An initial gap analysis identifies, within a few weeks, the priority gaps, the applicable proportionality regime and the most efficient compliance plan for your entity.
Frequently asked questions
DORA: common questions
What is the DORA Regulation?
The DORA Regulation (Digital Operational Resilience Act), Regulation (EU) 2022/2554, is the EU law that sets digital operational resilience requirements for financial entities. It has applied since January 17, 2025 and is directly applicable in all Member States, with no need for transposition.
Its aim is to ensure that financial entities can prevent, respond to and recover from all types of ICT-related disruptions and incidents. It is not a recommendation: it is a legal obligation backed by a penalty regime.
Which entities does DORA apply to?
DORA has a very broad scope. It covers credit institutions, investment firms, payment institutions and electronic money institutions, fund managers (SGIICs, AIFMs), insurance and reinsurance undertakings, pension funds, crypto-asset service providers (CASPs under MiCA), crowdfunding platforms and their critical ICT third-party service providers (CTPPs).
If your entity operates in the financial sector in the EU, it is very likely subject to DORA. The first step is to determine the level of application and the proportionality regime.
What are the five pillars of DORA?
DORA compliance services are built around the five pillars of the Regulation, which represent the mandatory compliance areas:
- ICT risk management: framework, policies, asset classification and security controls.
- Management, classification and reporting of major ICT-related incidents to the supervisory authorities.
- Digital operational resilience testing: annual basic testing and TLPT for significant entities.
- ICT third-party risk management: contracts, register of information, due diligence and CTPPs.
- Sharing of cyber threat information and intelligence among financial entities.
What does DORA require for ICT risk management?
DORA Article 6 requires a documented ICT risk management framework, approved by the management body and reviewed at least once a year. It must cover identification, protection, detection, response and recovery in relation to ICT risk.
- Inventory and classification of ICT assets by business criticality.
- Information security and access control policy.
- ICT business continuity plan and disaster recovery plan (DRP).
- Change, patch and vulnerability management procedures.
Senior management cannot delegate responsibility: DORA requires the management body to approve and directly oversee this framework.
What are CTPPs and why do they matter?
Critical ICT third-party service providers (CTPPs) are designated by the European Supervisory Authorities (EBA, ESMA, EIOPA) based on their systemic impact. They are subject to direct oversight at EU level.
The major cloud providers (Microsoft Azure, Amazon AWS, Google Cloud) are among the natural candidates. Entities that use them for critical or important functions must adapt their contracts, take part in inspections and have documented exit plans.
Contracts with ICT providers that support critical or important functions must include mandatory clauses: service description, SLAs, audit rights, data portability and an exit plan.
What are the deadlines for reporting ICT-related incidents?
DORA sets a harmonized regime for reporting major ICT-related incidents, with very tight deadlines:
- 4 hours from classification of the incident as major: initial notification to the supervisor.
- 72 hours: intermediate report with updated information on the incident.
- 1 month: final report with root cause analysis, impact and measures taken.
Failing to report on time is in itself an infringement of the DORA Regulation and can be penalized. Having the process in place before an incident occurs is the only real safeguard.
How long does DORA compliance take?
The timeline depends on the entity’s size, its cybersecurity maturity and the extent of the gaps identified:
- Small or medium-sized entities with basic maturity: between 6 and 12 months for full compliance.
- Significant entities or those with complex infrastructure: the project may take longer, especially for TLPT and contract remediation with critical providers.
As DORA has applied since January 2025, entities that have not yet started the process must act urgently to reduce their regulatory and reputational exposure.
What is the difference between DORA and NIS2?
DORA and NIS2 coexist, but DORA prevails as lex specialis for financial entities with regard to ICT risk management. A financial entity that complies with DORA is considered aligned with the equivalent NIS2 requirements.
Unlike NIS2, which has a broader sector scope, DORA is designed exclusively for the financial sector, with much more detailed requirements: stricter reporting deadlines, specific TLPT and an oversight regime for third-party providers with no equivalent in NIS2.
Operational guide
Practical guide: the DORA Regulation
DORA is not just an IT project: it has legal, contractual, corporate governance and regulatory compliance dimensions that require the active involvement of the legal department, compliance and senior management, not only the technology team.
The first mistake: treating it as an IT project
DORA requires approval and active oversight by the management body. Without the involvement of legal, compliance and senior management, the ICT risk framework starts life without the governance backing the Regulation requires.
The contract work: more complex than it looks
Adapting all contracts with ICT providers to DORA requirements, especially with dozens of active providers, is a major task that requires coordination between legal, procurement and IT over several months.
Documenting the process is as important as complying
DORA does not just require you to comply: it requires you to be able to demonstrate compliance to the supervisor at any time. A documented audit trail for every decision, policy and test carried out is essential.
DORA compliance plan in 6 steps
- Gap analysis: assess the current level of compliance against the five pillars of DORA, identify priority gaps and determine the applicable proportionality regime.
- ICT risk management framework: design and approve the framework under DORA Article 6, including an asset inventory, security policies, controls and a continuity plan.
- Incident reporting process: design and implement the process for classifying, managing and reporting incidents to the Bank of Spain, the CNMV or the DGSFP within the DORA deadlines (4h / 72h / 1 month).
- Contracts with ICT providers: review and renegotiate contracts to include the mandatory DORA clauses, create the register of information on contractual arrangements and classify critical providers (CTPPs).
- Resilience testing: carry out annual basic testing and, for significant entities, coordinate TLPT under the TIBER-EU framework.
- Documentation and training: document the entire process to evidence compliance to the supervisor, and train the management body and key teams.
If you want to start your entity’s DORA compliance work, see our fintech regulation services or our comprehensive fintech compliance practice.
DORA in operation
From obligation to system: how DORA is implemented in practice
You do not comply with the DORA Regulation by producing a document: it is a set of living processes (ICT risk management, incident reporting, third-party providers and resilience testing) that you demonstrate to the supervisor with a full audit trail.
1) ICT riskICT risk framework: the piece most often improvised
Without a documented framework, approved by the board and reviewed annually, the rest of DORA compliance has no foundation. It is the first piece the supervisor reviews.
- Asset inventory and classification
- Security and access control policies
- Continuity and recovery plan (DRP)
2) IncidentsIncident reporting: the clock starts at classification
4 hours for the initial notification, 72 hours for the intermediate report, 1 month for the final report. Without a process in place, any major incident is also a DORA infringement.
- Documented classification process
- Reporting channel to the supervisor
- Incident log with a full audit trail
3) ICT third partiesThird-party providers: the contract work that causes the most delays
Adapting contracts with all ICT providers, identifying CTPPs and documenting due diligence is the most time-consuming workstream and the one most underestimated at the outset.
- Mandatory DORA clauses in contracts
- Up-to-date register of information on ICT providers
- Documented exit plan for each provider
4) TestingResilience testing: basic testing and TLPT
All entities must carry out annual basic testing. Significant entities must coordinate TLPT with certified testers under the TIBER-EU framework, at least every three years.
Tip: for the supervisor, the plan to remediate weaknesses found in testing is as important as the testing itself.
Quick decisionDORA proportionality: what applies to your entity?
Small entities
Simplified regime: basic ICT framework, basic testing. No mandatory TLPT. Documented proportionality analysis.
Medium-sized entities
Full ICT framework, incident process, contracts with DORA clauses and annual basic testing with a remediation plan.
Significant entities
Full ICT framework + TLPT every three years + CTPP oversight + participation in European supervisory inspections.
DORA playbook
DORA in practice
ICT risk management
A documented framework, approved by the board, with an asset inventory, security policies and an ICT continuity plan reviewed annually.
Approved ICT risk policy, asset inventory, board minutes and a log of updates.
Incident reporting
Process for classifying, managing and reporting incidents to the Bank of Spain / CNMV / DGSFP within DORA deadlines (4h, 72h, 1 month).
Reporting procedure, incident log, reports sent to the supervisor and remediation plan.
Resilience testing
Annual basic testing for all entities; TLPT every three years for significant entities under TIBER-EU.
Test reports, plan to remediate weaknesses and, for TLPT, tester certification and supervisory validation.
ICT third-party providers
Third-party risk management policy, register of information on contractual arrangements, mandatory DORA clauses and due diligence on CTPPs.
Register of information on ICT providers, adapted contracts, due diligence reports and documented exit plans.
Governance and training
Management body directly responsible for the ICT framework, with specific DORA training and regular reporting on the state of operational resilience.
Approval minutes, training program, attendance records and reporting of resilience KPIs to the board.
Common mistakes in DORA compliance projects
Spot them before the project starts to avoid rework and supervisory exposure.
- Treating DORA as an IT-only project, without involving legal, compliance and senior management.
- Underestimating the contract work with ICT providers: adapting dozens of contracts takes months.
- Not documenting the compliance process: complying without evidence is as bad as not complying.
- Ignoring the proportionality regime and applying significant-entity requirements to small entities (or vice versa).
- Not implementing the incident reporting process before a major incident occurs.
Operational glossary
Key concepts: the DORA Regulation
If you are implementing DORA compliance at your entity, these terms come up in policies, in contracts and in your dealings with the supervisor. Understanding them properly avoids misinterpretations that later prove costly in supervisory proceedings.
DORABasics
Digital Operational Resilience Act
Regulation (EU) 2022/2554, applicable since January 17, 2025. A harmonized digital operational resilience framework for financial entities across the EU.
Supervisors in Spain: Bank of Spain, CNMV, DGSFP.
ICT frameworkPillar 1
ICT risk management framework
A documented system for identifying, protecting against, detecting, responding to and recovering from ICT risk. It must be approved and overseen by the management body.
Evidence: approved policy + board minutes + annual review.
Major ICT-related incidentPillar 2
Mandatory reporting
An ICT-related incident that exceeds the thresholds set in the DORA RTS. It must be reported to the supervisor within 4 hours (initial), 72 hours (intermediate) and 1 month (final).
Failing to report on time is an infringement in its own right.
TLPTPillar 3
Threat-led penetration testing
Advanced testing, mandatory for significant entities at least every three years, in line with the TIBER-EU framework.
Requires a certified tester and supervisory validation.
CTPPsPillar 4
Critical ICT third-party service providers
ICT providers designated by the EBA, ESMA or EIOPA based on their systemic impact. They are subject to direct oversight at EU level. Microsoft Azure, AWS and Google Cloud are natural candidates.
Entities that use them have additional obligations.
ProportionalityRegime
DORA proportionality principle
Small and non-interconnected entities can use a simplified regime for some requirements. Determining eligibility requires a documented analysis under the criteria in the RTS.
It is not automatic: it must be analyzed and documented.
RTS / ITSTechnical
Regulatory technical standards
Regulatory technical standards (RTS) and implementing technical standards (ITS) developed by the EBA, ESMA and EIOPA, setting out the specific requirements of each pillar of the DORA Regulation.
RTS are binding and supplement the Regulation.
TIBER-EUTesting
European framework for advanced testing
ECB framework for threat-led penetration testing (TLPT). In Spain, coordinated by the Bank of Spain and the CNMV. The methodological basis for DORA TLPT.
Applies to significant entities subject to mandatory TLPT.
Gap analysisDiagnosis
DORA gap analysis
Initial assessment of the current level of compliance against the five pillars of DORA. It identifies gaps, determines the proportionality regime and produces the compliance roadmap.
A mandatory first step before any compliance project.
Contact
Book a call
Tell us about your entity’s situation and we will explain which DORA services are a priority and how to structure the compliance plan efficiently.
DORA legal framework in Spain: Regulation (EU) 2022/2554 and technical standards
The DORA Regulation (Digital Operational Resilience Act) is the first EU law to establish a harmonized, comprehensive digital operational resilience framework specifically for the financial sector. It has applied since January 17, 2025 and is directly applicable in all Member States, with no need for national transposition. Unlike NIS2, which has a broader sector scope, DORA is designed exclusively for financial entities and their critical ICT third-party service providers, with much more detailed requirements and a dedicated supervisory regime.
Scope and proportionality
DORA applies to more than twenty types of regulated financial entities in the EU. However, the Regulation includes the principle of proportionality: small and non-interconnected entities have access to a simplified regime for some requirements. Determining whether an entity qualifies for the simplified regime requires a prior analysis of the criteria set out in the EBA, ESMA and EIOPA RTS, which must be documented and, in many cases, communicated to the supervisor.
Competent supervisors in Spain
In Spain, supervision of DORA compliance falls to three authorities depending on the type of entity: the Bank of Spain for credit institutions, payment institutions and EMIs; the CNMV for investment firms, fund managers and platforms; and the DGSFP (Directorate-General for Insurance and Pension Funds) for insurers and pension funds. The transposition of the DORA penalty regime is carried out through amendments to Spanish sectoral laws.
CTPPs and direct EU oversight
One of DORA’s most significant innovations is a regime of direct oversight by the European Supervisory Authorities (EBA, ESMA, EIOPA) over critical ICT third-party service providers (CTPPs). The major cloud providers (Microsoft Azure, Amazon AWS, Google Cloud) are among the natural candidates for designation as CTPPs. Entities that use them for critical or important functions must prepare for the contractual and operational implications of this designation.
DORA and NIS2: coexistence and lex specialis
DORA and NIS2 coexist, but DORA prevails as lex specialis for financial entities with regard to ICT risk management. A financial entity that complies with DORA is considered aligned with the equivalent NIS2 requirements. Financial entities should not ignore NIS2, but DORA is the primary reference standard for their digital operational resilience framework.
Fintech regulation services
Related areas
Resources and blog
Official sources
Key legislation, linked to the official text:
- Regulation (EU) 2022/2554 of December 14, 2022 on digital operational resilience for the financial sector (DORA)EUR-Lex · Official Journal of the EU
Legislation and links reviewed in .