DORA in brief

The Digital Operational Resilience Act, Regulation (EU) 2022/2554, has applied since 17 January 2025 to financial entities: credit institutions, payment and electronic money institutions, investment firms, insurers and reinsurers, crypto-asset service providers and others. As a regulation, it applies directly in every member state without waiting for national law.

An ICT supplier is not regulated by DORA itself unless the European Supervisory Authorities (ESAs) designate it as critical. But a financial entity must manage the risk of every ICT service it uses, under Articles 28 to 30, so it passes these requirements on to its suppliers through due diligence, questionnaires and contracts.

1. Your customer records you in its register

Every financial entity keeps a register of information on all its contracts for ICT services and reports it to its supervisor; the first registers were collected in 2025. Expect to be asked for:

  • your legal name and an identifier: a Legal Entity Identifier (LEI) or, for a company established in the EU, a European Unique Identifier (EUID);
  • a description of each service, which your customer classifies by how critical it is to them;
  • the countries where the service is provided and where data is processed and stored;
  • the subcontractors that take part in delivering the service.

2. Expect DORA clauses in your contract

Article 30 lists what every contract for ICT services must contain:

  • a clear description of the services, and whether and on what terms subcontracting is allowed;
  • the locations where services are provided and data is processed and stored, with advance notice of any change;
  • the protection of data, including personal data: availability, authenticity, integrity and confidentiality;
  • access to, recovery and return of the data in an easily accessible format if you become insolvent, stop the service or the contract ends;
  • service level descriptions;
  • assistance when an ICT incident related to your service occurs, at no extra cost or at a cost set in advance;
  • full cooperation with your customer’s supervisory and resolution authorities;
  • termination rights and minimum notice periods;
  • your participation in your customer’s ICT security awareness programmes and operational resilience training.

When the service supports a critical or important function, the contract must also include:

  • full service levels with precise quantitative and qualitative performance targets;
  • notice periods and reporting obligations, including any development that could affect the service;
  • business contingency plans that you implement and test, and appropriate ICT security measures;
  • your participation in your customer’s threat-led penetration testing where it applies;
  • unrestricted rights of access, inspection and audit for your customer, an auditor it appoints and its supervisor;
  • exit strategies, with a mandatory and adequate transition period.

3. Be ready to help with incident reporting

A financial entity reports a major ICT-related incident on a tight timeline, set by Delegated Regulation (EU) 2025/301:

  • an initial notification within 4 hours of classifying the incident as major, and no later than 24 hours after becoming aware of it;
  • an intermediate report within 72 hours of the initial notification;
  • a final report within one month of the latest intermediate report.

If the incident starts on your side, your customer needs from you, within hours: what happened, which services and data are affected, since when, and what you are doing about it. Agree on contacts and channels before you need them.

4. Know your own supply chain

For services that support critical or important functions, Delegated Regulation (EU) 2025/532, applicable since 22 July 2025, makes your customer assess the subcontractors you rely on. Keep an up-to-date list of the subcontractors and hosting providers behind your service and the conditions under which you use them, and announce material changes in advance.

5. Prepare for audits and tests

Customers that use you for critical or important functions can audit you, directly or through a third party, and may involve you in their threat-led penetration tests. A ready audit pack, with your policies, recent test results, access reviews and backup and restore records, makes these visits shorter.

6. Plan your customer’s exit

DORA requires financial entities to have exit strategies for ICT services that support critical or important functions. Document how a customer’s data is returned, in which formats, and how long the transition period lasts.

Critical providers and concentration risk

On 18 November 2025 the ESAs designated the first critical ICT third-party providers: 19 companies, including hyperscale cloud and data centre providers, now overseen directly at EU level. Your customers also weigh concentration risk: if your service depends on one of these providers, expect questions about that dependency and about your fallback.

The questionnaire checklist

  • An LEI or EUID ready to give.
  • A list of your services, with the countries where data is processed and stored.
  • A current list of subcontractors and hosting providers.
  • Service levels, with their measured history.
  • An incident procedure with named contacts and what you will report in the first hours.
  • A tested business continuity plan.
  • An audit pack: policies, test reports, access reviews, backup and restore evidence.
  • An exit plan: data formats, return procedure and transition period.

Where Swirl Cloud fits

If you deliver your service from Swirl Cloud, several answers come from the platform. You choose the hosting provider and country. The list of every outside service the platform contacts is a starting point for your subcontractor list. Availability is measured for each public address and reported monthly. Incident timelines are drafted from alerts, changes and sign-ins. And controls mapped to DORA (Articles 6, 9 to 12, 17, 19, 24, 25 and 28) come with an evidence pack for your customers’ auditors. Contract clauses, your register entries and your organization’s policies remain yours. See the controls and their evidence and where the data goes.