DORA
DORA — digital operational resilience for financial entities
The Digital Operational Resilience Act (DORA, Regulation (EU) 2022/2554) has applied since 17 January 2025. As a regulation it applies directly; in Lithuania, financial market participants are supervised by the Bank of Lithuania. DORA sets requirements for ICT risk management, incident reporting, digital operational resilience testing and ICT third-party risk.
Book a free consultationWho it's for
- Payment and e-money institutions
- Investment firms and crypto-asset service providers
- Insurance companies
- ICT providers serving financial clients — DORA reaches you through contracts
What you get
- DORA gap analysis applying the proportionality principle
- ICT risk management framework and policy set
- ICT incident classification and reporting process
- Register of information on ICT third-party service arrangements (the "ICT register")
- Review of business continuity and recovery plans, and a testing programme
- Support for ICT providers meeting their financial clients' requirements
Frequently asked questions
Why is your experience relevant to finance?
In 2016–2018 I was CIO for the Baltics at Compensa Vienna Insurance Group, running IT in a regulated insurance group. I know supervisor and auditor expectations from the inside.
Does DORA apply to us as an IT company?
Usually not directly. But if your clients are financial entities, they must build DORA requirements into contracts and check your compliance. I help you get ready.
Does DORA replace NIS2?
For financial entities, DORA is the sector-specific act for ICT risk. Some companies need to look at both — I'll help you sort it out.
Let's start with a 30-minute call
No commitment. The call is held online.