Digital Operational Resilience Act (Regulation (EU) 2022/2554)

dora_2022_2554

DORAv2022/2554

OfficialVerified

The Digital Operational Resilience Act (DORA) is a European Union regulation (Regulation (EU) 2022/2554) that sets a uniform framework for the digital operational resilience of the EU financial sector. Mandatory since 17 January 2025, it applies to financial entities (banks, insurers, investment firms, payment institutions, etc.) and to ICT third-party service providers. DORA is structured around five pillars: ICT risk management, ICT-related incident reporting, digital operational resilience testing, ICT third-party risk management, and information sharing. This Prowler mapping covers the technical controls auditable from cloud configuration; the organisational, contractual and supervisory obligations defined in DORA must be addressed outside of Prowler.

6requirements25checks

Prowler prowler-compliance-dora

Run this compliance with Prowler

Run in Prowler Cloud

Run

prowler cloudflare --compliance dora_2022_2554

Requirements (6)

DORA-Art7Financial entities shall use and maintain updated ICT systems, protocols and tools that are appropriate to the magnitude of operations supporting ICT functions, technologically resilient, and adequately equipped to securely process data. Cryptographic primitives, certificate hygiene and network segmentation are core to this requirement.10

Attributes

Pillar: ICT Risk Management
Article: Article 7
Article Title: ICT systems, protocols and tools

DORA-Art8Financial entities shall identify, classify and adequately document all ICT supported business functions, roles and responsibilities, the information assets and ICT assets supporting them, and their interdependencies. They shall on a continuous basis identify all sources of ICT risk, in particular the risk exposure to and from other financial entities.3

Attributes

Pillar: ICT Risk Management
Article: Article 8
Article Title: Identification

DORA-Art9Financial entities shall continuously monitor and control the security and functioning of ICT systems and tools and minimise the impact of ICT risk by deploying appropriate ICT security tools, policies and procedures. Encryption at rest and in transit, blocking of public exposure, network access controls, secret management and instance hardening are central to this article.24

Attributes

Pillar: ICT Risk Management
Article: Article 9
Article Title: Protection and prevention

DORA-Art10Financial entities shall have in place mechanisms to promptly detect anomalous activities, including ICT network performance issues and ICT-related incidents, and to identify potential single points of failure. Threat detection across compute, identity, storage and the API control plane is required for timely detection.3

Attributes

Pillar: ICT Risk Management
Article: Article 10
Article Title: Detection

DORA-Art25Financial entities shall ensure that tests are undertaken on ICT tools and systems, on critical ICT systems supporting all critical or important functions, at least yearly. Vulnerability assessments, deprecated component detection and certificate hygiene must be tracked.1

Attributes

Pillar: Digital Operational Resilience Testing
Article: Article 25
Article Title: Testing of ICT tools and systems

DORA-Art28Financial entities shall manage ICT third-party risk as an integral component of ICT risk within their ICT risk management framework. Cross-account access, trust boundaries, organization-level controls and dependency visibility are critical to monitor third-party exposure on AWS.2

Attributes

Pillar: ICT Third-Party Risk Management
Article: Article 28
Article Title: General principles (ICT third-party risk)