DORA Compliance Guide (2026): ICT Risk, Incident Reporting, Testing and Third Parties

Who it applies to

• Financial entities. DORA applies to 20 different types of financial entity, including banks, insurance companies and investment firms (EIOPA). The FMA notes it applies to "almost all" of the financial undertakings it supervises.
• ICT third-party service providers. They are affected indirectly through contracts, and directly if designated as CTPPs (FMA).
• Proportionality. Testing depth and frequency depend on size, complexity and risk profile (FMA). A simplified ICT risk management framework exists for certain smaller entities and is specified in Delegated Regulation (EU) 2024/1774 (FMA).

Key requirements

1. ICT risk management and governance

The management body is ultimately responsible. It must:

• adopt a digital operational resilience strategy
• set risk tolerance
• approve ICT business continuity and response and recovery plans
• plan training for all staff (FMA)

The ICT risk management framework needs an independent ICT control function and must be reviewed at least once a year. Entities must:

• keep inventories of ICT and information assets
• classify assets by risk
• monitor continuously
• apply access restrictions, strong authentication, network segmentation and patching
• maintain detection, response and recovery capabilities based on a business impact analysis (FMA)

2. Incident management, classification and reporting

An incident is major when critical services are affected and either:

• there was successful malicious unauthorised access that may cause data loss, or
• two or more materiality thresholds are met. The thresholds cover clients and transactions, reputational impact, duration and downtime, geographical spread, data impact and economic impact (FMA).

Under Delegated Regulation (EU) 2025/301, reports are due as follows:

• Initial notification: within 4 hours of classification, and no later than 24 hours after becoming aware of the incident.
• Intermediate report: within 72 hours of the initial notification, even if nothing has changed.
• Final report: within one month of the latest intermediate report (FMA).

The ESAs say these limits are aligned with NIS2 (EBA). Voluntary notification of significant cyber threats is also possible (FMA).

3. Digital operational resilience testing

All in-scope entities need a risk-based testing programme. It can include:

• vulnerability scans
• gap analyses
• source code reviews
• scenario-based tests
• penetration tests

Systems that support critical or important functions must be tested at least once a year. Identified significant entities must also perform TLPT on live production systems using a TIBER-EU-based methodology, generally once every three years. For the first cycle, this means between 17 January 2025 and 16 January 2028 (FMA).

4. ICT third-party risk

Entities must:

• adopt a third-party risk strategy approved by the management body
• carry out due diligence before contracting
• include mandatory contract terms
• maintain exit strategies
• keep a register of information for all ICT services, including subcontracting that supports critical or important functions

Competent authorities collect the registers, and the data feeds into CTPP designation (FMA).

5. Oversight of critical providers

A Lead Overseer (EBA, EIOPA or ESMA) can request information, investigate, inspect on site and issue recommendations to CTPPs. It is supported by Joint Examination Teams. Financial entities remain "fully responsible" for monitoring their providers (FMA).

Certification process and timeline

DORA has no certification. You demonstrate compliance through supervision, incident reports, test evidence and register submissions. For example, the FMA's 2026 register-of-information submission window ran from 16 February to 13 March 2026 (FMA).

Key dates:

Penalties

DORA relies on national competent authorities for supervision and sanctions. Austria, for example, has enacted national legislation that implements DORA (FMA). For critical providers, competent authorities can, as a last resort, require financial entities to partially or completely suspend their use of a CTPP's services (FMA).

Mapping to related frameworks

• NIS2: DORA is the sector-specific regime for financial entities, and incident timelines are aligned (EBA).
• Digital Omnibus: the Commission has proposed a single entry point for incident reporting across NIS2, GDPR, DORA and other acts (European Commission).
• ISO 27001 and ISO 22301: they support the ICT risk and continuity pillars. However, the FMA notes that DORA does not refer to specific standards (FMA).
• TIBER-EU: the basis for TLPT.
• CPS 234 and MAS TRM: comparable regimes in Australia and Singapore.

Readiness checklist

1. Confirm your entity type and whether the simplified framework applies.
2. Have the management body approve your resilience strategy and risk tolerance.
3. Build ICT asset inventories and classify them by risk.
4. Map your critical or important functions to the systems and providers behind them.
5. Implement incident classification against the 2024/1772 criteria, and run 4h/72h/1-month drills.
6. Produce an annual testing plan, and prepare for TLPT if you've been identified.
7. Complete your register of information and validate it against the templates.
8. Remediate contracts against DORA's contractual requirements, and document exit plans.
9. Review your ICT risk management framework at least annually.

Common pitfalls

• Classifying incidents slowly. The 4-hour clock starts at classification, but the 24-hour limit runs from discovery.
• Leaving gaps in the register. Missing subcontracting chains, or submissions that fail validation, will be rejected (FMA).
• Assuming CTPP oversight replaces your own monitoring. It doesn't.
• Treating DORA as an IT-only project. The management body is accountable.

How AssureCore helps

• The Controls Register and Cross-framework Mapping link DORA to ISO 27001 and NIS2.
• The Risk Register tracks ICT and third-party risks.
• Evidence Management, with expiry alerts, keeps test and review evidence current.
• Audit Reports export evidence packs for supervisors.

Frequently asked questions

Official references

• EIOPA – Digital Operational Resilience Act
• EBA – Joint Technical Standards on major incident reporting
• FMA Austria – DORA ICT risk management
• FMA Austria – DORA ICT-related incidents
• FMA Austria – DORA digital operational resilience testing
• FMA Austria – DORA managing ICT third-party risk
• FMA Austria – DORA oversight of critical ICT third-party providers
• FMA Austria – DORA legal bases
• EIOPA – ESAs designate critical ICT third-party providers (18 Nov 2025)
• European Commission – Simpler digital rules (Digital Omnibus)

Related frameworks

• NIS2 guide
• ISO 27001 guide
• PCI DSS guide
• MAS TRM guide