DORA
Regulation (EU) 2022/2554 of the European Parliament and of the Council of 14 December 2022 on digital operational resilience for the financial sector and amending Regulations (EC) No 1060/2009, (EU) No 648/2012, (EU) No 600/2014, (EU) No 909/2014 and (EU) 2016/1011
Published by European Parliament and Council of the European Union · Regulation (EU) 2022/2554 — applicable from 17 January 2025
ICT risk management, incident reporting, digital operational resilience testing, and oversight of ICT third-party providers for the financial sector.
How it’s structured
- 9 chapters and 64 articles
- Applies proportionality (Article 4): obligations scale to an entity's size and overall risk profile
Who it applies to
Financial entities defined in Article 2(1) — including credit institutions, payment and e-money institutions, investment firms, crypto-asset service providers, insurance and reinsurance undertakings — and their critical ICT third-party providers.
How Pentforge uses it in an engagement
- Gap analysis and evidence preparation designed for DORA's ICT risk-management and resilience-testing themes — not legal advice and not a certification
- Digital operational resilience testing support scoped to the client's entity category and proportionality tier
What you get
- A gap register mapped to DORA's risk-management requirements
- Testing evidence organized for the client's ICT risk register
Official source
Pentforge does not issue certificates
We assess against DORA — that is a statement about the work, not a certification. Pentforge holds no certifications of its own; the credentials our practitioners hold individually are listed on About.
Request a scoping call