01 ·
ICT risk management
A documented ICT risk framework approved by the management body: accountability sits with the board, not just IT. Asset mapping, protection, detection, response and recovery.
DORA: resilience is measured, not declared.
DORA requires financial entities to prove demonstrable digital operational resilience: ICT risk governed by the board, major incidents reported within hours, tests driven by the real threat. An attack on the financial sector is not a balance-sheet event: it is someone, with a name and known TTPs.
Regulatory framework
Reg. (EU) 2022/2554
RTS 2025/301
TIBER-EU
ESAs · EBA · ESMA · EIOPA
Operations
European SOC 24·7·365
Milan · since 2017
The five DORA pillars
Five obligations, one implicit requirement: operational capability.
DORA does not ask for policies: it asks you to detect, classify, report, test and oversee. Every pillar presupposes an operation that actually works, 24·7·365.
02 ·
Incident reporting
Classification of ICT incidents and reporting of major ones to the supervisor: 4 hours from classification, intermediate report at 72 hours, final within 1 month. Harmonised templates (RTS 2025/301).
03 ·
Resilience testing
A risk-proportionate testing programme, up to TIBER-EU based TLPT at least every 3 years for significant entities: scenarios built on the actors that actually target the sector.
04 ·
ICT third-party risk
Register of ICT contracts, mandatory clauses, exit strategies, direct European oversight of critical providers. Your supplier's resilience becomes part of yours.
05 ·
Information sharing
Voluntary exchange of cyber threat intelligence between financial entities: IOCs, TTPs, sector alerts. Sector defence is collective or it is nothing.
Proof · the timings DORA presupposes
Reporting in 4 hours requires detecting in minutes.
4h
initial notification
from classification (≤24h from detection)
from classification (≤24h from detection)
<15 min
Fortgale median TTD
from telemetry to alert
from telemetry to alert
<30 min
Fortgale median TTC
from detection to analyst action
from detection to analyst action
287
tracked adversary groups
and attack tools in our CTI
and attack tools in our CTI
Scope
Who is in scope of DORA.
More than 20 categories of financial entities: banks, investment firms, insurers and reinsurers, payment and e-money institutions, fund managers, trading venues, crypto-asset service providers, plus critical ICT providers designated by the European authorities. Unlike NIS2, DORA is a regulation: identical across the EU, no national transposition, applicable since 17 January 2025.
After DORA · 2026
After DORA: the 2026 requests from the ECB, ESAs and national supervisors.
DORA remains the baseline: none of the 2026 communications creates a new rule. They ask financial entities to demonstrate, with a deadline and a named owner, that their controls hold against attacks that use artificial intelligence. For the AI systems the entity itself adopts: AI Security.
7 July 2026 ·
ECB · letter «Addressing AI-enabled cybersecurity threats»
Sent to the CEOs of significant banks: an action plan delivered to the Joint Supervisory Teams by 31 October 2026. The next phase is under way: horizontal analysis by the ECB and JST follow-up; the IT Risk Questionnaire has been moved to February 2027.
17 July 2026 ·
National supervisors · Banca d'Italia and IVASS
In Italy, Banca d'Italia (less significant banks and supervised intermediaries) and IVASS (insurers and reinsurers) issued their own communications on 17 July 2026, with the same logic: resilience against AI-enabled threats assessed by the board, with a plan, a named owner and a report to the supervisor by 31 December 2026, on top of DORA rather than beside it. Your national supervisor remains the counterpart for DORA reporting and inspections.
7 July 2026 ·
ESRB · Warning ESRB/2026/3
The European Systemic Risk Board rated systemic cyber risk as «severe»: the sector is expected to prepare for a disruptive incident, not to argue about its likelihood.
31 July 2026 ·
ESAs · Statement JC 2026 25
Governance and consistent supervision of the risks of frontier AI models: no new obligation, but an expectation that AI use and AI-enabled threats sit inside the DORA ICT risk framework.
National rulebooks are being aligned as well: in Italy, Banca d'Italia repealed the ICT sections of Circular 285 in February 2026 and now refers directly to DORA, so the requirements live in the regulation and its RTS, not in national guidance.
Pillar 4 · third parties
Register of information and ICT third-party providers.
Article 28 DORA requires every financial entity to keep a register of information on all contractual arrangements with ICT third-party providers, kept up to date and available to the authority. A managed MDR, SOC or CTI service is an ICT service: Fortgale enters your register as an ICT third-party provider, and its resilience becomes part of yours. The contractual safeguards of Article 30 (service and level description, data location, access and audit rights, incident assistance, exit strategy) are reflected in the service contract; the evidence on organisation, sites, continuity and data handling is collected in the trust center, ready for ex ante due diligence and periodic review.
How Fortgale supports DORA
Three capabilities, three pillars covered.
Pillars 1-2
MDR · detection and reporting
Detection and containment in minutes, evidence and timeline ready for the 4-hour notification. Incident classification rests on facts, not estimates.
Discover MDR →Pillars 3-5
CTI · scenarios and TLPT
Intelligence on 287 tracked adversary groups and attack tools: threat-led scenarios for TIBER-EU testing and a contribution to sector information sharing.
Discover CTI →Sector
Banking & Finance
The Fortgale vertical for the financial sector: actors active against European banks, documented cases and service architecture.
Go to the vertical →FAQ
Frequently asked about DORA.
Who is in scope of the DORA Regulation?
EU financial entities: banks, investment firms, insurers, payment and e-money institutions, fund managers, trading venues, crypto-asset service providers, plus designated critical ICT providers. Supervision sits with your national financial authority together with the ESAs (EBA, ESMA, EIOPA).
What are the reporting deadlines for a major ICT-related incident?
Three stages (RTS 2025/301): initial notification within 4 hours of classifying the incident as major, and no later than 24 hours from detection; intermediate report within 72 hours of the initial notification; final report within 1 month of the intermediate report, with complete root cause analysis. If a deadline falls outside business hours, it moves to noon of the next working day.
Does DORA replace NIS2 for banks?
DORA is lex specialis: on the obligations it covers (ICT risk, reporting, testing) it prevails over NIS2 for financial entities. Non-financial suppliers in the chain remain in the NIS2 perimeter.
What are TLPT?
Threat-led penetration tests on the TIBER-EU framework: scenarios built on the actors and TTPs that actually target your sector. Mandatory at least every 3 years for significant entities. Their quality depends on the threat intelligence behind them.
How often must TLPT be carried out?
At least every 3 years for the financial entities identified by their authority under Article 26 DORA, on live production systems supporting critical or important functions. Entity selection criteria, methodology and tester requirements are set by RTS 2025/1190, on the TIBER-EU framework. The authority may require a higher frequency.
Is DORA already in force?
Yes, since 17 January 2025, in all Member States and with no national transposition. The technical standards on reporting, testing and third parties are operational too.
Where to start
Knowing the adversary is the first act of defence. Stopping them in time is the second.
A DORA assessment clarifies the distance between your operational capability and the one the regulation presupposes. European SOC headquartered in Milan since 2017, 24·7·365: we reply within one business day.