Topic starter
12/06/2026 12:10 am
TL;DR: DORA requires most EU financial entities to build a comprehensive ICT risk management framework, report major incidents quickly, test resilience regularly, and tighten oversight of third-party providers, according to Veriff. The practical shift is that operational resilience is now a governance discipline, not a technical side project.
Editorial analysis by NHI Mgmt Group, based on content published by Veriff: “Digital Operational Resilience Act (DORA): Key steps for financial services success”.
Key questions
Q: Who is accountable for ICT risk management under DORA?
A: Senior management is accountable, with regulated entities expected to assign clear responsibilities for ICT risk oversight, reporting, and resilience testing.
Q: Why does DORA make third-party oversight more demanding?
A: Because regulated firms remain accountable even when a critical service is run by a provider.
Q: What breaks when incident reporting for ICT events is slow or inconsistent under DORA?
A: Slow or inconsistent incident reporting weakens containment, obscures regulatory accountability, and makes it harder to learn from operational failures.
Practitioner guidance
- Define ICT risk ownership Assign board-level and operational owners for ICT risk decisions, incident escalation, and third-party oversight so accountability is explicit in the control model.
- Link incident response to reporting obligations Update incident playbooks so detection, evidence preservation, root-cause analysis, and regulator notification follow one sequenced workflow.
- Review third-party contracts and access lifecycles Check that provider agreements cover incident notice, audit rights, recovery expectations, and termination of access when services end.
Bottom line: DORA reframes ICT resilience as a governed responsibility across financial services, with clear ownership and documented oversight.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
This topic was modified 1 day ago by NHI Mgmt Group
12/06/2026 9:14 am
DORA turns operational resilience into an identity and governance problem, not just a security programme. The article’s emphasis on board accountability, continuous monitoring, and third-party oversight shows that resilience now depends on who owns access, who approves exceptions, and who can evidence control performance. For IAM and IGA teams, this is a governance shift as much as a technical one, because the control failures DORA cares about are organisational before they are infrastructural.
A few things that frame the scale:
- An unplanned outage in a cloud environment costs an average of $9,000 per minute, per the Uptime Institute’s 2023 Global Data Center Survey.
A question worth separating out:
Q: What is the difference between resilience testing and ordinary vulnerability scanning?
A: Vulnerability scanning finds known weaknesses, while resilience testing checks whether the organisation can continue, recover, and report under realistic disruption. DORA cares about the business and regulatory outcome, not just the presence of technical flaws. Both matter, but only testing proves recovery capability.
👉 Read our full editorial: DORA is reshaping ICT risk governance in financial services
This post was modified 1 day ago by NHI Mgmt Group