DORA compliance and ICT resilience
Domain 1 - DORA compliance and ICT resilience. This domain tests whether you can place DORA in the EU regulatory landscape, identify who and what is in scope, and apply its governance and proportionality rules rather than treating it as a generic cybersecurity checklist.
The instrument and its scope
DORA is Regulation (EU) 2022/2554, directly applicable across the EU from 17 January 2025. It covers a closed list of financial entities - credit institutions, payment and e-money institutions, investment firms, insurers and reinsurers, crypto-asset service providers, central securities depositories, trading venues and others. Some entities are excluded, and SME insurance intermediaries and certain small, non-interconnected firms can use the simplified framework in Article 16. Proportionality adjusts the manner of compliance, not the existence of the core obligations.
Governance is the spine
The management body is accountable. It sets and approves the digital operational resilience strategy, defines risk appetite, approves the ICT risk management framework, allocates budget and reviews effectiveness. It cannot delegate accountability to a CTO or to a cloud provider. Outsourcing may transfer operations, never regulatory responsibility.
Relationship with other law
DORA is sector-specific and, for ICT risk, operates as lex specialis for financial entities; it does not displace GDPR, which continues to govern personal-data processing. Incident reporting under DORA is separate from GDPR breach notification.
Worked example
A payment institution with 20 staff is not interconnected. It may use the simplified ICT risk framework, but it still must classify and report major incidents, maintain a register of ICT contractual arrangements and notify authorities. Reasoning: Article 16 reduces the sophistication of the framework; it does not switch off Chapter III or Article 28.
Traps
Assuming the simplified framework exempts a firm from incident reporting; treating board approval as a one-off; and assuming a vendor's certification proves DORA compliance.