DORA: ICT risk framework and register of information

The Digital Operational Resilience Act — Regulation (EU) 2022/2554, DORA — applies from 17 January 2025 to almost every regulated financial entity in the EU: credit institutions, payment and e-money institutions, crypto-asset service providers, investment firms, fund managers, creditors under several regimes and more. It sets one standard for ICT risk management and one register of ICT third-party arrangements. This guide explains what DORA requires, who must comply, how proportionality works for smaller firms, what the register of information contains, and what our DORA services deliver.

The guide is general information, not legal advice.

The five pillars of DORA

1. ICT risk management framework (Articles 5–16) — governance by the management body, a documented framework, identification and protection of ICT assets, detection, response and recovery, backup policies, learning and communication. A simplified framework applies to certain small entities (Article 16).
2. ICT-related incident management and reporting (Articles 17–23) — classification of incidents and major incident reporting to the competent authority on fixed deadlines.
3. Digital operational resilience testing (Articles 24–27) — a testing programme proportionate to the entity; threat-led penetration testing only for entities designated by the authority.
4. ICT third-party risk (Articles 28–30) — a strategy, due diligence before contracting, mandatory contract clauses, exit plans, and the register of information on all ICT third-party arrangements (Article 28(3)), submitted to the authority annually.
5. Information sharing (Article 45) — voluntary arrangements on cyber threat intelligence.

Who must comply

DORA applies to the financial entities listed in its Article 2, including payment and e-money institutions, crypto-asset service providers authorised under MiCA, investment firms and managers of alternative investment funds, among others. If your firm holds, or is applying for, one of these authorisations, DORA applies to it from the date the regulation itself started to apply — 17 January 2025 — or from the date of authorisation if that is later. We confirm the exact scope for your firm in writing before the work starts.

Proportionality

DORA applies to large and small firms, but the depth of the framework follows the entity's size, risk profile and the nature of its services (Article 4). A small payment institution does not need the tooling of a bank — but it needs every required document, an owner for each process and evidence that it works.

What the register of information contains

Under Article 28(3), every financial entity keeps a register of all its contractual arrangements for ICT services provided by third parties, makes the register available to its competent authority on request, and reports on new arrangements at least once a year. In practice the register lists, for each ICT third-party provider: what it provides, which function of the firm depends on it, and whether that function is critical or important. A register has to stay consistent with the contracts actually in force — not with what was true when it was first built — which is why it needs an annual update rather than a one-time entry.

How we build the framework, step by step

1. Gap analysis. We compare the firm's current ICT governance, documents and third-party contracts against the five pillars above.
2. Framework and policies. We draft the ICT risk management framework and the supporting policies, sized to the firm under the proportionality principle.
3. Incident classification and reporting procedure. We set out how an ICT incident is classified and who reports it to the competent authority, and on what deadlines.
4. Testing programme. We draft a testing programme proportionate to the entity.
5. Third-party risk policy. We draft the due diligence process and the contract-clause checklist for new ICT providers, and review the clauses already in force.
6. Register of information. We build the first register, in the required template, from the contracts you hold.

Common mistakes

• Treating proportionality as an exemption. A small firm still needs every required document and an owner for each process — proportionality changes the depth, not the list.
• Letting the register go stale. The register has to be updated whenever an ICT contract changes, not only once a year when the formal update is due.
• No named owner. A framework without a person responsible for each part is a document, not a working framework.
• Treating DORA as a one-off project. Incident reporting and the annual register update are recurring obligations, not a single deliverable.

What is and is not included

Our service covers the ICT risk management framework, the policies, the incident classification and reporting procedure, the testing programme, the third-party risk policy and the register of information. It does not include the ICT systems and the technical testing themselves — the firm's own IT function, or its technical supplier, carries those out; our documents describe them, govern them and record them.

How long it takes

A first DORA framework and register typically takes 8–12 weeks to build; the annual register update is a recurring, shorter engagement.

Our DORA services

• DORA ICT risk management framework and tooling — from €39,500: gap analysis, the framework and policies, incident classification and reporting procedure, testing programme, third-party risk policy with contract clause checklist, and the first register of information;
• DORA register of information — annual update — from €2,400 / year: updating the register in the ITS template and supporting its submission each year.

DORA-aligned ICT documents are also part of a MiCA application and of payment and e-money institution applications; ordering DORA together with the licence avoids writing the same documents twice. See also compliance audits.

What you receive

• a DORA framework proportionate to your firm, with owners and evidence;
• the register of information in the required format;
• where ordered, the annual update of the register.

The amounts are our fees for the standard scope; no VAT is added. All communication takes place by email.

Ready to start? Choose the DORA framework or the annual register update. Order.

Official sources

The laws this article names, each linked to its official text, as read on 9 October 2026. For the Estonian acts we read the English translation in Riigi Teataja (opens in a new tab); the legally binding text is the Estonian one.

• Regulation (EU) 2022/2554 (opens in a new tab) — EUR-Lex

To see which of our services your company needs, open the Business Navigator.

Frequently asked questions

Related guides

• Banking and payment partners for fintechs
• Compliance audit for regulated firms
• Supervisory reporting after authorisation

More on this topic: Compliance services.