— RegulationDORA Compliance
Digital operational resilience: can your financial institution withstand a major IT incident — and prove it?
Regulatory pillars
Member states
Directly applicable
Incident notification
Are you affected by DORA ?
Determine in 3 minutes whether your organization is subject to the DORA regulation and your level of obligations.
Launch the DORA simulatorDORA (Digital Operational Resilience Act) has been applicable since January 17, 2025. This European regulation requires financial entities — banks, insurers, asset managers, payment service providers — to ensure their digital operational resilience against IT incidents.
Unlike a directive, DORA is a directly applicable regulation: there is no national transposition. Requirements are the same across all 27 member states. And they are demanding.
The most structuring — and most complex — aspect concerns ICT third-party oversight. DORA requires mapping all your technology dependencies, assessing associated risks, formalizing strict contractual clauses, and maintaining continuous monitoring. Conitiv provides you with the tools and expertise to meet these requirements.
The 5 pillars of DORA
ICT risk management
A formalized framework covering identification, protection, detection, response, and recovery. Management is directly responsible for ICT governance.
Incident management and reporting
Classification, escalation, and notification procedures to competent authorities. Major incidents must be reported within strict deadlines.
Resilience testing
Tests proportionate to the risk profile. For the most significant entities: advanced TLPT tests supervised by authorities.
ICT third-party oversight
Dependency mapping, risk assessment, mandatory contractual clauses, continuous monitoring, exit plans. The most demanding component.
Information sharing
Voluntary framework for sharing threat intelligence and vulnerability information among sector participants.
The major challenge: overseeing your ICT third parties
DORA mandates structured oversight of all your ICT providers. This goes far beyond a simple annual questionnaire. You must map your dependencies, assess each provider's risks, formalize precise contractual clauses, and maintain continuous monitoring.
directly applicable across the EU
For critical ICT providers, DORA requires in-depth assessment, documented exit plans, and resilience tests involving these third parties. Most financial institutions discover they lack both the visibility and the tools to meet this level of requirement. This is exactly the problem Conitiv solves.
How Conitiv helps you comply with DORA
Complete DORA questionnaire
Aligned with the regulation's 5 pillars. Usable for your self-assessment and to evaluate your ICT providers.
Cyber rating of your third parties
Non-intrusive scoring of each provider's cyber posture. Score out of 1,000, continuous monitoring.
Third-party portfolio
Complete mapping of your ICT providers, classified by criticality, with scores and alerts.
Evidence-based audit
Document-based verification by our PASSI-qualified partners for your most critical third parties.
Evidence centralization
Contracts, attestations, audit reports — all archived and traceable.
DORA impose aux entités financières d'évaluer en continu la résilience cyber de leurs prestataires TIC critiques — une exigence à laquelle répond directement le Rating Cyber fournisseurs de Conitiv.
Yes. DORA is a directly applicable European regulation since January 17, 2025. Unlike NIS2, there is no national transposition — requirements apply as-is across all member states.
DORA applies to all financial entities: credit institutions, investment firms, insurance companies, asset management companies, payment service providers, and their critical ICT providers.
Yes. The Conitiv portfolio allows you to import and map all your ICT providers, classify them by criticality, score them automatically, and track changes in their security posture.
Ready to structure your DORA compliance?
expert Conitiv