DORA – Digital operational resilience in the financial sector

Strengthening cybersecurity

DORA stands for the Digital Operational Resilience Act. The associated requirements, which are part of the European Commission’s Digital Finance Package, are based in particular on the DORA Regulation, which applies to almost all financial undertakings supervised by the Financial Market Authority (FMA) from 17 January 2025. In particular, its objective is to strengthen cybersecurity in the EU financial sector’s cybersecurity as was already addressed in the European Commission’s FinTech Action plan 2018.

DORA – FMA Activities and Legal Bases

DORA – FMA Activities

Information about the FMA's supervisory activities conducted in relation to DORA, including documents made available, expert guidance and relevant information for supervised entities.

DORA – Legal Bases

DORA – objectives and thematic areas

DORA – ICT Risk Management

DORA – ICT-related incidents

DORA – Digital operational resilience testing

DORA – Managing of ICT third-party risk

DORA – Oversight framework of critical ICT third-party service providers

DORA – Exchange of information and contingency exercises

Contact

DORA-related questions should be addressed to the following e-mail address:

[email protected]

The contents on this website as well as hyperlinks to third party websites serve the purpose of providing general and non-binding information. These “Questions and Answers” do not constitute the FMA’s binding interpretation and in particular do not constitute interpretation within the scope of the question and answer processes (Q&As) of the three European Supervisory Authorities (EBA – European Banking Authority, ESMA – European Securities and Markets Authority, and EIOPA – European Insurance and Occupational Pensions Authority). All information on this website is provided without any guarantee, especially with regard to the up-to-dateness, completeness and correctness, and the FMA, including its employees or the persons responsible for this website, assume no liability whatsoever for the content; in addition, the FMA neither guarantees nor assumes liability for the use of hyperlinks or content that can be accessed via them.