DORA
DORA compliance for financial entities and their ICT providers.
ICT risk, incidents, resilience testing and third-party risk in one system. DORA applies since 17 January 2025.
What we do for you
- ICT risk-management framework
- Major ICT incident classification and reporting
- Resilience testing plans
- Register of Information for ICT third-party providers
- Contract checks against DORA
Why AnnexOps
Banks and insurers are adopting AI fast. We cover DORA and the AI Act rules for credit scoring and insurance pricing AI in one place.
Frequently asked questions
Are we in scope as an ICT provider to a bank?
DORA applies directly to financial entities. As an ICT third-party provider you are mainly affected through your contracts: your financial-entity customers must include DORA’s contract requirements and list you in their Register of Information. Providers designated as critical are also overseen directly by the European Supervisory Authorities.
What goes in the Register of Information?
Every contractual arrangement a financial entity has with ICT third-party providers: who the provider is, which services and functions it supports, whether those are critical or important functions, the subcontracting chain, contract dates and where data is stored and processed. Supervisors can request it, and it is reported to them regularly.
How do DORA and NIS2 overlap?
For financial entities, DORA is the sector-specific law: where it applies, its ICT risk-management and incident-reporting rules take precedence over NIS2’s. Much of the work, such as risk management, incident handling and supplier security, maps across both, so we manage it once.
