DORA is live: resilience is now a contract term
From 17 January 2025, EU financial firms must prove they can withstand and recover from IT disruption — including problems at their suppliers. If you build or run software for them, expect new questions.
By the Xuru Technologies team · 31 January 2025
Key takeaways
- The Digital Operational Resilience Act (DORA) has applied across the EU since 17 January 2025.
- It covers banks, insurers, investment firms, payment and e-money institutions, crypto-asset providers and more.
- Firms must manage ICT risk, report major incidents, test resilience and control risks from ICT third-party providers.
- Suppliers should expect contract clauses on security, incident notice, audit rights, exit plans and subcontracting.
Regulators have spent years watching outages and cyberattacks ripple through the financial system. DORA is the EU's answer: one rulebook that treats IT resilience as seriously as capital and liquidity.
What happened
As Jones Day summarises, DORA became applicable on 17 January 2025. The Central Bank of Ireland describes its five pillars: ICT risk management, incident reporting, digital operational resilience testing, management of ICT third-party risk, and information sharing. Firms also keep a register of their ICT contracts, and the most important tech providers can be designated as critical and supervised directly at EU level.
What it means for businesses
- Fintechs and payment start-ups need documented policies, incident playbooks and tested backups — not just good intentions.
- Agencies and software suppliers serving EU financial clients will see longer security questionnaires and contracts covering service levels, incident notification, data location, audit and exit.
- Hosting and websites count. Customer portals, onboarding forms and marketing sites that collect data are part of the ICT picture.
- Good suppliers gain an edge. Clear documentation and quick, honest incident communication now win work.
What to do now
| If you are… | Start with |
|---|---|
| A fintech or payment firm | Map your critical services and every supplier behind them |
| A web or software supplier | Prepare a security pack: access control, backups, patching, incident process |
| Both | Agree an exit plan: how data and code move if the contract ends |
This is general information, not legal advice. For website security basics, see our website maintenance guide.
Frequently asked questions
Does DORA apply to non-EU suppliers?
DORA's obligations sit with EU financial entities, but they must pass many requirements on to their ICT suppliers through contracts, wherever those suppliers are based.
Is a company website covered?
Systems that support the firm's services or process its data fall within ICT risk management. A marketing site that collects customer information should be secured and documented accordingly.
What is a critical ICT third-party provider?
A provider designated by EU supervisors because many financial firms depend on it, typically large cloud and technology companies. They face direct oversight.
Websites and portals built for regulated clients.
We document security, backups and incident handling from day one, so your compliance team gets answers, not excuses.
Websites, payments, digital marketing, AI automation, consultancy and practical technology training — for businesses and aspiring professionals worldwide.
Saturday – Sunday: closed
Leave a Reply