If your organization serves EU financial institutions as a bank, payment processor, fintech, cloud provider, or IT services firm, DORA may apply to you regardless of where you’re headquartered. (Even if you are in the United States!)
The regulation has been in full force since January 17, 2025, and in 2026 regulators moved from reviewing readiness frameworks to issuing formal assessments and remediation orders
This page covers who DORA covers, what it requires at the system level, and what regulators are examining right now.
What Is DORA?
DORA (Digital Operational Resilience Act, Regulation EU 2022/2554) is a binding EU regulation that sets uniform requirements for ICT risk management, incident reporting, operational resilience testing, and third-party oversight across the EU financial sector. It covers banks, insurers, investment firms, payment providers, fintechs, crypto-asset service providers, and the ICT providers that serve them.
Unlike a directive which requires each EU member state to pass national legislation and results in variation across countries DORA is a regulation. It applies identically across all 27 EU member states with no national grace period. Think of it as the financial sector’s equivalent of GDPR, and like GDPR, its scope reaches beyond EU borders.
Does DORA Apply to US Companies?
For some US organizations, yes.
US financial entities with EU operations. If your firm operates in the EU, such as having a branch, subsidiary, or regulated entity serving EU customers, that operation is directly in scope under Article 2 of DORA. An EU subsidiary of a US banking group must demonstrate DORA compliance in its own right. The parent company’s group-wide compliance program doesn’t satisfy the requirement for the subsidiary.
US ICT providers serving EU financial clients. If your organization provides technology services, such as cloud infrastructure, SaaS, data centers, managed security, or software to EU-regulated financial institutions, DORA’s third-party requirements reach you through your contracts with those clients. EU financial firms are required by DORA to impose specific contractual obligations on their ICT providers: audit rights, exit provisions, and incident reporting requirements. Large enough providers may be designated as Critical Third-Party Providers (CTPPs) and subject to direct EU oversight.
In November 2025, the ESAs published their first list of 19 designated CTPPs, including Amazon Web Services, Google Cloud, Microsoft, Oracle, and SAP.
A quick scope check:
- Does your firm hold an EU financial services license or operate a regulated EU entity? → Directly in scope.
- Does your firm provide ICT services under contract to EU-regulated banks, insurers, or investment firms? → In scope through third-party requirements; potentially subject to direct oversight if designated as a CTPP.
- Does your firm have zero EU financial clients and no EU regulated operations? → Likely out of scope. Worth a formal legal determination rather than a self-assessment.
Enforcement in 2026: What’s Actually Happening
DORA has been in force since January 2025. Regulators spent 2025 reviewing readiness frameworks and identifying gaps. In 2026, that shifted to active enforcement.
National Competent Authorities (NCAs) are now conducting formal compliance assessments, cross-checking Register of Information submissions, and issuing remediation orders where gaps are found. The European Central Bank has integrated DORA compliance into its SREP (Supervisory Review and Evaluation Process) for significant institutions.
The first formal enforcement actions are expected to target incident reporting failures and Register of Information quality deficiencies specifically delays between first awareness and initial notification, misclassification of incidents, and final reports with inadequate root cause analysis. The gap between intention and reality is significant. According to a Deloitte survey, only 50% of financial institutions expected to reach full compliance by end of 2025, with 38% pushing targets into 2026. A subsequent Deloitte Luxembourg survey found just 25% of institutions confident in their compliance posture.
What DORA Requires: The Five Pillars at System Level
DORA is built around five pillars. Three have direct implications for server and system configuration; two are broader governance and business continuity requirements.
1. ICT Risk Management Institutions must maintain an ICT (Information and Communication Technology, the EU regulatory term for what most US IT teams would just call “IT infrastructure.”) risk management framework covering identification, protection, detection, response, and recovery. At the system level, this means documented and enforced security baselines for all ICT assets in scope, continuous monitoring for configuration drift and unauthorized changes, change management with audit trails, and ICT asset inventories with documented dependencies.
2. ICT Incident Management and Reporting Major ICT incidents must be reported to the competent authority on strict timelines: an initial notification within 4 hours of classification, an intermediate report within 72 hours, and a final report within one month including root cause analysis. This is where current enforcement attention is focused.
3. Digital Operational Resilience Testing All in-scope entities must conduct annual basic ICT resilience testing — vulnerability assessments, scenario-based tests, network security assessments, and gap analysis on ICT risk controls. Significant institutions must additionally undergo Threat-Led Penetration Testing (TLPT) every three years. The first TLPT notifications are expected in 2026.
4. ICT Third-Party Risk Management Financial entities must maintain a Register of Information documenting all contractual ICT third-party arrangements. The first submission deadline was April 30, 2025. The 2025 pilot exposed serious data quality issues — many firms discovered they had no centralized view of their ICT vendor relationships, with contracts scattered across procurement teams and business units. The second annual Register cycle concluded March 2026. For US ICT providers: EU clients will require DORA-compliant contractual clauses from you, including audit rights, exit plans, and SLAs. The subcontracting RTS entered into force July 22, 2025, after the European Commission rejected an earlier draft for exceeding its mandate.
5. Information Sharing Voluntary arrangements for sharing cyber threat intelligence among financial entities. No hardening or configuration control requirements here.
Where Regulators Are Looking
Two failure points are showing up consistently in 2026 DORA assessments.
Configuration controls that exist on paper but can’t be demonstrated. Article 9 of DORA requires institutions to show that ICT systems are “managed and controlled” with “appropriate monitoring and control tools.” An institution with a hardening policy that can’t show it’s applied and maintained across production systems is exposed. This is the same gap that shows up in FFIEC and PCI DSS exams — the distance between having a policy and having evidence the policy is followed.
Register of Information quality. The 2025 submission cycle found 35–50% of contracts had at least one missing or invalid mandatory field at most banks. The 2026 cycle is running under active regulator scrutiny.
Checklist: What You Should Be Able to Demonstrate
- ICT asset inventory with system roles and dependencies documented
- Security baselines defined per system role — domain controllers, SQL hosts, file servers treated differently, not a single generic policy applied uniformly
- Point-in-time configuration state evidence (scan output, GPO reports, agent-collected data) showing baselines are enforced in production, not just defined in policy
- Change log with timestamp, user/service account, modified setting, and before/after value for every configuration change
- Drift detection with alert-to-remediation workflow tracked and documented — not just alerts going to an inbox
- Independent validation of configuration state, separate from the team managing the systems
- Register of Information for ICT third-party arrangements, complete and submission-ready
- Incident reporting process with documented classification criteria and 4-hour/72-hour/1-month reporting chain
- Evidence package organized by system/asset ID, not scattered across tickets, emails, and spreadsheets
For MSPs and ICT Service Providers
If you provide managed IT, cloud, or security services to EU financial institutions, DORA’s obligations flow down to you through contract. Expect your EU clients to request audit rights and right-to-inspect provisions, exit plans and service continuity commitments, incident notification aligned to DORA’s 4-hour initial reporting window, and evidence that your own systems meet appropriate configuration standards.
If you manage configuration across multiple financial sector clients, enforcement gaps at your end become your clients’ regulatory findings. CHS gives MSPs a single console to enforce and evidence configuration state across multiple client environments without per-client manual checks.
How CalCom Fits
CHS handles the server and system hardening layer that DORA’s ICT risk management requirements call for: enforced baselines, drift detection, change logging, and audit-ready evidence. Learning Mode lets teams see the impact of a configuration change before pushing it, which matters for DORA’s change control expectations.
CHS is not a GRC platform. It doesn’t manage your Register of Information, handle incident classification or reporting workflows, or replace the governance layer DORA requires from senior management and boards. DORA’s scope is broad — ICT risk management, third-party oversight, resilience testing, and incident reporting all sit within it. CHS addresses the configuration enforcement and evidence layer at the foundation of that framework, which is consistently where supervisory findings originate.
How DORA Relates to ISO 27001
If your organization is already ISO 27001 certified, the control mapping gives you a head start. DORA’s ICT risk management framework aligns substantially with ISO 27001’s Annex A controls for asset management, access control, and system security. That said, ISO 27001 is a voluntary standard; DORA is a binding regulation with enforcement consequences. Certification doesn’t demonstrate DORA compliance, and DORA’s specific requirements — incident reporting timelines, TLPT, third-party Register obligations — go further than ISO 27001 requires.
How CalCom Can Help
DORA’s configuration requirements are live and being examined in active 2026 supervisory cycles. If your organization serves EU financial institutions directly or as an ICT provider the evidence gap between having a hardening policy and being able to demonstrate it’s enforced is exactly where regulatory findings originate. That’s the gap CHS closes. If you want to see what it captures automatically and where your team is still pulling evidence by hand, and how CalCom can help, contact us today to speak to an expert.
