Regulation (EU) 2022/2554, in application since 17 January 2025. Being a regulation it applies directly in every Member State, with no national transposition to wait for.
Five pillars
ICT risk management, inside a governance frame the management body owns. Management, classification and reporting of ICT-related incidents on a harmonised template. Digital operational resilience testing, including threat-led penetration testing for the entities the authorities designate. Management of third party ICT risk, with mandatory contractual content, exit strategies and a register of information covering every arrangement. And information sharing on cyber threats between entities.
It reaches the suppliers
ICT providers serving the financial sector inherit requirements through the contract, and those designated as critical third party providers come under direct oversight by the European Supervisory Authorities. A cloud, software or managed service vendor selling into finance is inside the perimeter whether or not it is itself a financial entity.
How it relates to NIS2
NIS2 is a directive, covers many sectors and is transposed nationally. DORA is a regulation, covers the financial sector, applies directly and is far more prescriptive about testing and about supplier contracts. For financial entities DORA operates as the specific regime, and it takes the lead where both would otherwise apply.