Financial entities depend entirely on functioning IT, and many of them use the same cloud and software providers. If such a provider fails or is attacked, several institutions can be hit at once. DORA is intended to ensure that the financial sector withstands such disruptions. The regulation applies directly in all member states; in Austria, the Financial Market Authority (FMA) is responsible.
Who does DORA apply to?
Art. 2 lists, among others, credit institutions, payment and e-money institutions, investment firms, crypto-asset service providers, insurance and reinsurance undertakings, institutions for occupational retirement provision, and credit rating agencies. According to the FMA, this covers almost all financial entities it supervises. ICT third-party service providers, that is, providers of IT and cloud services for financial entities, have a separate role. The three European supervisory authorities EBA, EIOPA, and ESMA designate particularly important providers as critical and supervise them directly; according to the FMA, the first list was published in November 2025.
The five pillars of DORA
- ICT risk management: a documented framework for protection, detection, response, and recovery under the responsibility of management.
- Handling and reporting of ICT-related incidents: classify incidents and report major incidents to the supervisory authority.
- Digital operational resilience testing: regular tests; certain financial entities must carry out threat-led penetration tests (TLPT) on live systems at least every three years.
- Management of ICT third-party risk: contracts with minimum content, a register of all ICT services, exit strategies.
- Information sharing: voluntary exchange of threat information between financial entities.
DORA and NIS2
DORA is a sector-specific legal act within the meaning of the NIS2 Directive; the recitals call it a lex specialis. For financial entities, the DORA rules therefore take precedence; according to the FMA, this is also laid down in Austria in the NISG 2026 (Austrian Network and Information Systems Security Act 2026). For ICT service providers, by contrast, the NISG 2026 generally applies in full if they are covered themselves. Whether this applies to your company can be clarified with the free NIS2 applicability check.
Practice for SMBs
Even if you are not a financial entity, you will feel DORA: as an IT service provider, software company, or data center for a bank or insurer. Expect extended contract clauses, audit and access rights, requirements for reporting channels, and participation in tests. Helpful are a documented security management system such as an ISMS, practiced procedures for incident response, and robust business continuity management. Municipalities are generally not directly affected by DORA.
Risks and typical mistakes
- Paper only: Policies without practiced procedures fail every test.
- Gaps in the register: Unrecorded cloud services and subcontractors make third-party risk invisible.
- No exit plan: If you do not know how to replace a critical provider, you are dependent on it in an emergency.
How TOMORIS relates
EXPERTS Strategy & Consulting translates requirements into a prioritized roadmap and supports architecture and security reviews. This entry is a general overview and does not replace legal advice.