Digital Operational Resilience Act (Regulation (EU) 2022/2554)

dora_2022_2554

DORAv2022/2554

OfficialVerified

The Digital Operational Resilience Act (DORA) is a European Union regulation (Regulation (EU) 2022/2554) that sets a uniform framework for the digital operational resilience of the EU financial sector. Mandatory since 17 January 2025, it applies to financial entities (banks, insurers, investment firms, payment institutions, etc.) and to ICT third-party service providers. DORA is structured around five pillars: ICT risk management, ICT-related incident reporting, digital operational resilience testing, ICT third-party risk management, and information sharing. This Prowler mapping covers the technical controls auditable from cloud configuration; the organisational, contractual and supervisory obligations defined in DORA must be addressed outside of Prowler.

18requirements202checks

Prowler prowler-compliance-dora

Run this compliance with Prowler

Run in Prowler Cloud

Run

prowler aws --compliance dora_2022_2554

Requirements (18)

DORA-Art5Financial entities shall have a sound, comprehensive and well-documented ICT internal governance and control framework. Senior management is accountable for ICT risk and shall enforce strong identity, authentication and least-privilege policies for privileged identities, including the root account.17

Attributes

Pillar: ICT Risk Management
Article: Article 5
Article Title: Governance and organisation

DORA-Art6Financial entities shall have an ICT risk management framework that is sound, comprehensive and well-documented, enabling them to address ICT risk quickly, efficiently and comprehensively and to ensure a high level of digital operational resilience. This includes continuous configuration recording, security findings aggregation and an enterprise-wide visibility plane.8

Attributes

Pillar: ICT Risk Management
Article: Article 6
Article Title: ICT risk management framework

DORA-Art7Financial entities shall use and maintain updated ICT systems, protocols and tools that are appropriate to the magnitude of operations supporting ICT functions, technologically resilient, and adequately equipped to securely process data. Cryptographic primitives, certificate hygiene and network segmentation are core to this requirement.17

Attributes

Pillar: ICT Risk Management
Article: Article 7
Article Title: ICT systems, protocols and tools

DORA-Art8Financial entities shall identify, classify and adequately document all ICT supported business functions, roles and responsibilities, the information assets and ICT assets supporting them, and their interdependencies. They shall on a continuous basis identify all sources of ICT risk, in particular the risk exposure to and from other financial entities.8

Attributes

Pillar: ICT Risk Management
Article: Article 8
Article Title: Identification

DORA-Art9Financial entities shall continuously monitor and control the security and functioning of ICT systems and tools and minimise the impact of ICT risk by deploying appropriate ICT security tools, policies and procedures. Encryption at rest and in transit, blocking of public exposure, network access controls, secret management and instance hardening are central to this article.33

Attributes

Pillar: ICT Risk Management
Article: Article 9
Article Title: Protection and prevention

DORA-Art10Financial entities shall have in place mechanisms to promptly detect anomalous activities, including ICT network performance issues and ICT-related incidents, and to identify potential single points of failure. Threat detection across compute, identity, storage and the API control plane is required for timely detection.16

Attributes

Pillar: ICT Risk Management
Article: Article 10
Article Title: Detection

DORA-Art11Financial entities shall put in place a comprehensive ICT business continuity policy, including ICT response and recovery plans, that ensures the continuity of ICT-supported critical or important functions. Operational alarming, automated event routing and tested recovery actions are essential.8

Attributes

Pillar: ICT Risk Management
Article: Article 11
Article Title: Response and recovery

DORA-Art12Financial entities shall develop and document backup policies and procedures specifying the scope of data subject to backup and the minimum frequency of the backup, as well as restoration and recovery procedures and methods. Backups must be encrypted, retained, and resources must be designed for recoverability across availability zones and regions.27

Attributes

Pillar: ICT Risk Management
Article: Article 12
Article Title: Backup policies and procedures, restoration and recovery procedures and methods

DORA-Art13Financial entities shall have in place capabilities and staff to gather information on vulnerabilities and cyber threats, perform post ICT-related incident reviews, and continuously feed lessons learnt back into the ICT risk assessment process. Findings aggregation and continuous insights drive this cycle.5

Attributes

Pillar: ICT Risk Management
Article: Article 13
Article Title: Learning and evolving

DORA-Art14As part of the ICT risk management framework, financial entities shall have in place crisis communication plans enabling a responsible disclosure of ICT-related incidents or major vulnerabilities to clients, counterparts and the public. Reliable, encrypted and access-controlled notification channels are required.8

Attributes

Pillar: ICT Risk Management
Article: Article 14
Article Title: Communication

DORA-Art17Financial entities shall define, establish and implement an ICT-related incident management process to detect, manage and notify ICT-related incidents. Comprehensive trail logging, log integrity protection, retention and centralisation of ICT events are foundational requirements.22

Attributes

Pillar: ICT-Related Incident Reporting
Article: Article 17
Article Title: ICT-related incident management process

DORA-Art18Financial entities shall classify ICT-related incidents and shall determine their impact based on criteria such as the number of clients affected, duration, geographical spread, data losses, and criticality of the services affected. Severity-aware threat detection across the estate underpins this classification.9

Attributes

Pillar: ICT-Related Incident Reporting
Article: Article 18
Article Title: Classification of ICT-related incidents and cyber threats

DORA-Art19Financial entities shall report major ICT-related incidents to the relevant competent authority and may, on a voluntary basis, notify significant cyber threats. Detective metric filters, change-tracking alarms and reliable notification topics are needed to surface and route reportable events.16

Attributes

Pillar: ICT-Related Incident Reporting
Article: Article 19
Article Title: Reporting of major ICT-related incidents and voluntary notification of significant cyber threats

DORA-Art24Financial entities shall establish, maintain and review a sound and comprehensive digital operational resilience testing programme, as an integral part of the ICT risk management framework. Continuous vulnerability discovery, configuration assessment and instance manageability are foundational.6

Attributes

Pillar: Digital Operational Resilience Testing
Article: Article 24
Article Title: General requirements for the performance of digital operational resilience testing

DORA-Art25Financial entities shall ensure that tests are undertaken on ICT tools and systems, on critical ICT systems supporting all critical or important functions, at least yearly. Vulnerability assessments, deprecated component detection and certificate hygiene must be tracked.13

Attributes

Pillar: Digital Operational Resilience Testing
Article: Article 25
Article Title: Testing of ICT tools and systems

DORA-Art28Financial entities shall manage ICT third-party risk as an integral component of ICT risk within their ICT risk management framework. Cross-account access, trust boundaries, organization-level controls and dependency visibility are critical to monitor third-party exposure on AWS.17

Attributes

Pillar: ICT Third-Party Risk Management
Article: Article 28
Article Title: General principles (ICT third-party risk)

DORA-Art30Contractual arrangements with ICT third-party service providers shall be set out in writing and include, at minimum, agreed service levels and clear allocation of rights and obligations. Privilege boundaries, least-privilege policies and absence of administrative wildcards are the technical guardrails that enforce these contractual constraints inside AWS.16

Attributes

Pillar: ICT Third-Party Risk Management
Article: Article 30
Article Title: Key contractual provisions

DORA-Art45Financial entities may exchange amongst themselves cyber threat information and intelligence, including indicators of compromise, tactics, techniques and procedures, cyber security alerts and configuration tools. Centralised threat detection, sensitive data discovery and trail-based intelligence enable participation in such information-sharing arrangements.9

Attributes

Pillar: Information Sharing
Article: Article 45
Article Title: Information-sharing arrangements on cyber threat information and intelligence