---
title: "DORA 360º: Governance, Risk and Continuity in the Financial Ecosystem"
description: Explore DORA's impact on the financial ecosystem, focusing on governance, risk management, and compliance requirements for digital operational resilience.
image: https://blog.isecauditors.com/hubfs/ria-en-2026-la-obligacion-legal-ya-esta-en-marcha.png
---

English

- [Spanish](https://blog.isecauditors.com/dora-360-gobernanza-riesgo-y-continuidad-en-el-ecosistema-financiero)
- [English](https://blog.isecauditors.com/en/dora-360-governance-risk-and-continuity-in-the-financial-ecosystem)

[![290x123px\_isecauditors](https://blog.isecauditors.com/hs-fs/hubfs/ISEC%20Media/Blog%20Media/290x123px_isecauditors.png?width=290&height=91&name=290x123px_isecauditors.png) ![290x123px\_isecauditors](https://blog.isecauditors.com/hs-fs/hubfs/ISEC%20Media/Blog%20Media/290x123px_isecauditors.png?width=290&height=91&name=290x123px_isecauditors.png)](https://blog.isecauditors.com/?hsLang=en)

- [← www.isecauditors.com](https://www.isecauditors.com/)
- [academy.isecauditors.com](https://academy.isecauditors.com/)

- [← www.isecauditors.com](https://www.isecauditors.com/)
- [academy.isecauditors.com](https://academy.isecauditors.com/)

[DORA Implementation](https://blog.isecauditors.com/en/tag/dora-implementation)

# DORA 360º: Governance, Risk and Continuity in the Financial Ecosystem

[Alberto Villar Arévalo](https://blog.isecauditors.com/en/author/alberto-villar)  Oct 21, 2026, 10:40:55 AM

# DORA in 2026: The Adaptation Period Is Over

 DORA has been fully applicable since 17 January 2025. As of September 2026, there is no longer a general adaptation period: entities within its scope must have implemented the applicable requirements and retain evidence demonstrating their effectiveness.

DORA: From Regulatory Timeline to Effective Supervision

| **16/01/2023** | **17/01/2025** | **18/11/2025** | **28/09/2026** |
| --- | --- | --- | --- |
| Entry into Force | Mandatory application of DORA | **Initial designation of critical ICT third-party providers** | Compliance already in force and subject to supervision |
| **Key Legal Point: DORA Does Not Require Transposition DORA is a European Union Regulation. Article 64 establishes that it is binding in its entirety and directly applicable in every Member State from 17 January 2025. It should not be confused with Directive (EU) 2022/2556, which amends various sectoral directives and does require national transposition. The status of that Directive does not suspend, delay, or affect the obligations established under the DORA Regulation.** |  |  |  |

# Scope: The Financial Ecosystem and Its ICT Providers

DORA has a broad scope and covers, among others, credit institutions, payment and electronic money institutions, investment firms, insurance and reinsurance undertakings, certain pension entities, market infrastructures, management companies, crypto-asset service providers, and other financial entities listed in Article 2.

Its impact also extends to technology providers. A cloud, data centre, telecommunications, support, software development, managed services, or cybersecurity provider may not qualify as a “financial entity” under DORA, but can still be subject to contractual requirements and evidence requests from its financial-sector clients. If designated as a critical ICT third-party service provider, it also falls under the European supervisory framework.

# DORA 360°: The Pillars of Digital Operational Resilience

DORA structures digital operational resilience through several interconnected areas. Governance underpins them all: the management body must approve, oversee, and review the ICT risk framework, assign responsibilities and resources, and ensure that identified deficiencies are remediated.

| **Block** | **What DORA Requires** | **Practical Evidence** |
| --- | --- | --- |
| Governance and ICT Risk Management | ICT risk management framework, roles and responsibilities, asset inventory and classification, protection, detection, response, recovery, and continuous improvement. | Approved framework, risk matrix, asset inventories, metrics, management decisions, and action-tracking records. |
| Incident Management and Reporting | Detect, record, classify, respond to, and report major ICT-related incidents within the applicable timelines. | Procedures, classification criteria, decision logs, reporting templates, and testing or simulation evidence. |
| Resilience Testing | Regularly test systems and applications and, for selected entities, conduct advanced threat-led testing. | Testing plans, results, identified vulnerabilities, remediation activities, and closure validation records. |
| Third-Party Risk and Continuity | Manage ICT dependencies, concentration risk, contractual arrangements, subcontracting, business continuity, and exit strategies. | Register of information, supplier assessments, contracts, exit plans, and continuity testing records. |
| Information Sharing and Cooperation | Enable the secure exchange of cyber threat information where appropriate and cooperate with authorities and third parties. | Coordination mechanisms, communication channels, agreements, and traceability of shared information. |
| **A Simple DORA Maturity Test Select a critical or important function and review it end-to-end: What service does it provide? Which assets and data does it depend on? What risks threaten it? Which providers support it? How would an incident be detected? What would be recovered first? What evidence demonstrates that the plan works? If these answers exist only in separate documents and cannot be connected together, compliance remains fragile.** |  |  |

# Governance and ICT Risk Management

DORA assigns ultimate responsibility for ICT risk to the management body. It is not enough to delegate ICT risk management to technology or security teams. Senior management must define responsibilities, approve and review the framework, understand exposure to risks and third parties, allocate resources, and maintain sufficient knowledge to assess the consequences of technology-related decisions.

The ICT risk management framework must link the identification of functions and assets with protection and prevention measures, detection capabilities, response and recovery mechanisms, backup and restoration processes, and business continuity arrangements.

Audit activities and remediation tracking are equally important. An organisation may have comprehensive policies in place and still face compliance risks if findings remain unresolved, controls do not generate evidence, or corrective measures are not validated. DORA requires governance to extend through to the verifiable closure of deficiencies.

# Incidents and Testing: Respond and Demonstrate

The management of major ICT-related incidents is subject to harmonised classification criteria and specific reporting timelines.

Initial notifications must be submitted as soon as possible and no later than four hours after an incident is classified as major, and within twenty-four hours of becoming aware of it. Intermediate reports must be submitted no later than seventy-two hours after the initial notification, while final reports must be delivered within one month following the intermediate report or its latest update.

| **Deliverable** | **Timeline** | **Practical Implication** |
| --- | --- | --- |
| **Initial Notification** | ≤ 4 hours from classification as a major incident and ≤ 24 hours from becoming aware of the incident | The entity must be able to detect, classify, escalate, and have a responsible person with the authority to report the incident. |
| **Intermediate Report** | ≤ 72 hours from the initial notification | Must consolidate the impact assessment, recovery status, provisional root cause, and measures taken. |
| **Final Report** | ≤ 1 month from the intermediate report or its latest update | Must include the root cause analysis, resolution details, costs/losses, lessons learned, and corrective actions. |
| **Resilience Testing** | Annually for systems supporting critical or important functions; TLPT for selected entities, generally every 3 years | Testing must generate evidence and a remediation plan whose completion can be validated. |
| **Testing Completes the Cycle: Having plans in place is not enough. Entities that are not classified as microenterprises must test, at least annually, all systems and applications supporting critical or important functions. Advanced Threat-Led Penetration Tests (TLPT) are reserved for entities identified under Article 26 and are generally performed at least every three years, unless otherwise determined by the competent authority.** |  |  |

# Third Parties, Concentration Risk and Continuity

Outsourcing does not outsource responsibility. DORA explicitly establishes that financial entities remain fully accountable even when using third-party services.

As a result, organisations must maintain a register of ICT service arrangements, distinguish those supporting critical or important functions, conduct due diligence, assess concentration and substitutability risks, review contractual provisions, and prepare exit strategies that can be executed without compromising service continuity.

| **Area** | **What the DORA Approach Requires** | **Useful Evidence** |
| --- | --- | --- |
| **Register and Dependencies** | Identify ICT arrangements, providers, subcontractors, services, and the functions they support. | A complete and up-to-date Register of Information, aligned with the criticality of supported functions. |
| **Contracting and Monitoring** | Assess risks, perform due diligence, evaluate concentration risk, and establish contractual clauses covering oversight, audit rights, incident management, and subcontracting. | Supplier assessments, reviewed contracts, service-level monitoring records, and risk assessments. |
| **Continuity and Exit** | Prepare for supplier substitution or exit without compromising critical or important services. | Exit strategies, alternative providers, assigned responsibilities, transition timelines, and testing evidence. |

The European oversight framework for critical third-party providers confirms that this risk is no longer theoretical. However, such supervision complements, rather than replaces, the responsibility of each financial entity for managing its own technological dependencies. \[6\]

# The Impact of Being Unable to Demonstrate Compliance

In 2026, the primary risk is no longer failing to complete a compliance project on time, but failing to demonstrate to supervisors that controls exist and operate effectively.

DORA enables supervisory actions, investigations, corrective measures, and the application of sanctions. In addition, organisations and their suppliers may face operational and commercial challenges in procurement processes, accreditation activities, or outsourcing decisions if they are unable to provide sufficient evidence of compliance. \[1\]

| **Impact** | **What May Happen** |
| --- | --- |
| Regulatory | **Information requests, supervisory findings, corrective measures, and sanctions in accordance with the applicable national and sector-specific framework.** |
| Operational | **Inadequate recovery capabilities, prolonged service unavailability, or dependency on providers without a viable alternative.** |

# Compliance Approach: GAP Analysis, Implementation and Internal Assessment

The most effective way to address DORA is through a phased approach, supported by evidence from the very beginning. The objective should not be to produce documentation, but to close verifiable gaps and establish a sustainable operating model. At Internet Security Auditors, we propose a three-stage approach that enables organisations to understand their starting point, implement the necessary measures, and ultimately verify independently that the outcome can withstand regulatory scrutiny.

| **ISecAuditors Phase** | **Objective** | **Key Deliverables** |
| --- | --- | --- |
| 1. GAP Analysis and Scope Assessment | Determine applicability, requirements, proportionality, and the actual level of compliance with DORA and its technical standards. | Requirements and evidence matrix; identification of critical and important functions; assessment of governance, risk management, incident management, testing, and third-party risk; prioritised gaps and Action Plan. |
| **2. Implementation** | Close identified gaps and translate requirements into operational processes, assigned responsibilities, and sustainable evidence. | Documentation framework; ICT risk management methodology; business continuity and recovery framework; incident management and reporting processes; testing programme; third-party register and management process; contract review; metrics and training programme. |
| **3. Internal Assessment / Audit** | Independently verify that controls are implemented, effective, and supported by sufficient evidence. | Evidence sampling; interviews and testing activities; findings tracking; validation of remediation actions; assessment report and executive summary for senior management. |

A well-executed GAP assessment also helps avoid unnecessary investments. Many organisations already have mature capabilities through ISO 27001, business continuity programmes, risk management frameworks, sector-specific regulations, or previous audits. The key is to leverage those capabilities, identify which DORA requirements remain uncovered, and prioritise actions based on criticality, dependencies, and remediation effort.

Internet Security Auditors can support organisations throughout the entire lifecycle: applicability and scope assessment, GAP analysis, Action Plan development, implementation support, risk and third-party reviews, business continuity, technical testing, and internal assessment or audit. An internal assessment provides an independent, evidence-based view before a supervisory review or stakeholder audit.

# Conclusions

DORA is no longer a future project. Since 17 January 2025, it has been a directly applicable obligation, and by 2026 the regulatory and supervisory framework is fully operational. For financial entities, the key question is no longer whether policies are in place, but whether they can demonstrate that their critical functions can withstand, respond to, and recover from disruptions caused by technology failures or essential service providers.

Starting with a GAP analysis transforms that question into a manageable action plan: identifying real gaps, prioritising implementation efforts, and subsequently verifying through an internal assessment or audit that controls are effective and supported by sufficient evidence. This approach reduces regulatory uncertainty and, more importantly, strengthens the resilience that DORA is designed to protect.

[![cta-dora-from-compliance-to-resilience](https://blog.isecauditors.com/hs-fs/hubfs/ISEC%20Media/Blog%20Media/cta-dora-from-compliance-to-resilience.jpg?width=696&height=297&name=cta-dora-from-compliance-to-resilience.jpg)](https://www.isecauditors.com/en/dora-implementation)

Referencias  
[i. Regulation (EU) 2022/2554 (DORA) of 14 December 2022 on digital operational resilience for the financial sector. Articles 2, 5–16, 17–23, 24–27, 28–45, 50–51 y 64.](https://eur-lex.europa.eu/legal-content/ES/TXT/?uri=CELEX:32022R2554)  
[ii. Directive (EU) 2022/2556 of 14 December 2022 amending certain directives as regards digital operational resilience for the financial sector.](https://eur-lex.europa.eu/eli/dir/2022/2556/oj/spa)  
[iii. Commission Delegated Regulation (EU) 2024/1772 establishing criteria and thresholds for the classification of ICT-related incidents and cyber threats.](https://eur-lex.europa.eu/eli/reg_del/2024/1772/oj/spa)  
[iv. Commission Delegated Regulation (EU) 2025/301 establishing the content and timelines for initial notifications, intermediate reports, and final reports on major ICT-related incidents.](https://eur-lex.europa.eu/eli/reg_del/2025/301/oj/spa)  
[v. Commission Implementing Regulation (EU) 2024/2956 laying down standard templates for the register of information on contractual arrangements with ICT third-party service providers.](https://eur-lex.europa.eu/eli/reg_impl/2024/2956/oj/spa)  
[vi. European Supervisory Authorities (ESAs) / EBA – DORA Oversight: Oversight framework and critical ICT third-party service providers.](https://www.eba.europa.eu/activities/direct-supervision-and-oversight/digital-operational-resilience-act/dora-oversight)  
[vii. Internet Security Auditors – DORA Implementation: GAP analysis, Action Plan, and compliance support services.](https://www.isecauditors.com/en/dora-implementation)

Sources consulted on 11 September 2026. Tables and summaries prepared by the author based on the cited sources.

- [Tweet](https://twitter.com/share)

---

![author-image](https://blog.isecauditors.com/hubfs/Logo_isecauditors_contraccion_HP.png)

[Alberto Villar Arévalo](https://blog.isecauditors.com/en/author/alberto-villar)

PCI SSA, PCI QSA, CISSP, CSSLP, ISO 27001 L.A., CSFPC, SFPC   
 Security Consultant   
 Consulting Department

---

[Legal Notice](https://www.isecauditors.com/aviso-legal)

[Policy Privacy](https://www.isecauditors.com/politica-privacidad)

[Cookie Policy](https://www.isecauditors.com/politica-cookies)

<https://www.facebook.com/ISecAuditors> <https://twitter.com/ISecAuditors> <https://www.instagram.com/ISecAuditors/> <https://www.linkedin.com/company/internet-security-auditors/> <https://www.youtube.com/ISecAuditors>

---

Copyright © 2026 - All rights reserved

```json
{
  "@context" : "https://schema.org",
  "@type" : "BlogPosting",
  "author" : {
    "@type" : "Person",
    "name" : "Alberto Villar Arévalo",
    "url" : "https://blog.isecauditors.com/en/author/alberto-villar"
  },
  "dateModified" : "2026-10-21T08:40:55.250Z",
  "datePublished" : "2026-10-21T08:40:55.000Z",
  "headline" : "DORA 360º: Governance, Risk and Continuity in the Financial Ecosystem",
  "image" : [ "https://blog.isecauditors.com/hubfs/ria-en-2026-la-obligacion-legal-ya-esta-en-marcha.png" ],
  "mainEntityOfPage" : {
    "@id" : "https://blog.isecauditors.com/en/dora-360-governance-risk-and-continuity-in-the-financial-ecosystem",
    "@type" : "WebPage"
  },
  "publisher" : {
    "@type" : "Organization",
    "logo" : {
      "@type" : "ImageObject",
      "url" : "https://blog.isecauditors.com/hubfs/isec_logo.png"
    },
    "name" : "Internet Security Auditors, S.L."
  }
}
```