The free DORA guide
Explore what DORA means for the firms within its scope, and the questions to ask about technology, suppliers and operational resilience. Use the guide to shape your next discussion.
Use the free guide to explore scope, monitoring, evidence and exit planning across legal, risk and security teams.
DORA, explained
DORA stands for the Digital Operational Resilience Act. It is an EU law for financial firms in scope. It covers how they manage technology risks, respond to serious incidents, test their resilience and oversee technology suppliers.
DORA has applied since 17 January 2025. Start by checking whether your financial entity falls within its scope. It is not a blanket law for every UK business. UK firms may still be affected through EU operations or contracts with EU financial customers.
Firms in scope must manage technology risk, report major technology incidents, test resilience and manage supplier risk. That includes clear responsibilities and evidence that the arrangements work. The detailed duties depend on the firm and the services involved.
A failed payment system or unavailable banking app can stop customers paying bills or reaching their money. Resilience means preparing for disruption, limiting its impact and restoring the service. A written plan only helps if people can use it under pressure.
Identify the services customers depend on. Map the systems, people and suppliers behind them. Then check your response plans and evidence. Logica helps turn the gaps into clear actions, with an owner and a way to check that each improvement works.
UK financial firms should also check the separate UK rules that apply to them. Read the ESMA DORA overview and FCA operational resilience guidance.
Where questions arise
The guide explores common areas of uncertainty in implementation.
DORA uses the term ICT services for information and communication technology services. For a financial firm in scope, start by understanding which technology services it uses and how they support the business. Keep a clear record of the arrangements and the teams responsible. A practical review connects each provider to the service, data and customer impact, rather than treating every supplier as the same kind of risk.
Criticality is about the impact if a service fails. A function may be critical or important because disruption would seriously affect the firm’s services, performance or ability to meet its obligations. Assess the function the technology supports, not just the supplier’s size. Record the reasons for the decision. This helps identify where stronger checks and arrangements are needed and avoids confusing an important service with a provider formally designated critical by regulators.
Using a supplier does not remove an in-scope financial firm’s responsibility for its resilience. The provider has its own responsibilities, while the firm still needs oversight of the services it relies on. Make the split clear in working arrangements and contracts. Teams should know who monitors performance, handles incidents and makes decisions when something goes wrong. Clear ownership helps prevent a concern being passed between organisations without action.
DORA-related work needs to become part of how the organisation runs. Policies alone will not show whether teams can recognise a problem, coordinate a response or restore an affected service. Connect supplier reviews, testing, incident handling and evidence records with everyday work. Agree owners and review points. This helps financial firms move from interpreting a requirement to showing how it is put into practice.
What the guide covers
Explore how the requirements connect with existing risk and resilience programmes.
Start by making responsibility clear across the financial firm and its technology providers. Security, risk, compliance, legal, procurement and service owners each need to understand their part. Record who approves arrangements, monitors performance and acts on incidents. A supplier can perform work for the firm, but that does not simply transfer away the firm’s responsibility. Clear roles make oversight more useful and reduce delays when a decision is needed.
Oversight means checking whether a supplier continues to deliver the service and safeguards you agreed. Monitoring provides the information needed to make that judgement. Review performance, incidents, changes and unresolved actions against the risk of the service. Keep the evidence and decisions clear. For financial firms in scope, this supports ongoing management of technology supplier risk rather than treating checks as a one-off task before signing a contract.
An exit plan explains how you could leave or replace a technology provider without unacceptable disruption. It considers what happens if the supplier fails, service quality deteriorates or the relationship must end. For ICT services supporting critical or important functions, DORA requires exit strategies. Think through data transfer, alternative arrangements and the time needed to move. A plan should be practical enough to assess and test, not just a statement that another supplier could be found.
Proportionality means applying requirements with regard to the firm’s size, risk profile and the nature and complexity of its activities. It does not mean ignoring a requirement because a business is small. Explain why the chosen approach is suitable for the risk. A smaller supplier can still support an important customer service. Clear reasoning helps teams focus effort where failure could cause the most harm while maintaining the required safeguards.
Who it is for
For leaders responsible for interpreting, implementing or overseeing DORA-related ICT and third-party risk requirements.
Especially useful where accountability spans several teams and needs a coordinated approach.
Purpose of the guide
The guide explores how DORA requirements are interpreted, put into practice and governed. It does not provide legal advice or restate the regulation.
Discuss how the requirements relate to your organisation.
Free practical guides
Practical guidance to help you spot gaps, ask better questions and decide where to focus. Explore a guide to see what’s inside.
If you decide why and how personal data is used, you are the controller. A supplier using it on your instructions is a processor. Under UK GDPR, the UK’s data protection rules, you must:
TPRM is a way to manage risk, not one law for every supplier. Duties depend on the data, relationship and sector. Logica helps you turn these checks into practical work.
Get the free supplier risk guideFor financial firms within its scope, DORA sets legal duties across technology risk, incident reporting, testing and supplier oversight. Your firm remains responsible when services are outsourced.
DORA is not a blanket UK rule. EU operations or supplying EU financial firms may bring duties or contract requirements. Logica helps you assess the gaps and plan the work.
Get the free DORA guideGet the free guide
Request the DORA Compliance guide using the form.
For a wider view of the operating model, explore our Third-Party Risk Management guide ↗.
Read our Privacy Policy ↗