DORA · pillar 1 of 5
Scope — finance, and the suppliers behind it
Twenty-odd categories of financial entity, plus the ICT providers they depend on.
- 1 Twenty categories, and the providers behind them DORA covers around twenty categories of financial entity — banks, insurers, investment firms, payment and e-money…
- 2 DORA beats NIS2 where both apply Where a financial entity is in scope of both, DORA applies instead of NIS2 for ICT risk management and incident…
- 3 Proportionate, not optional DORA is applied proportionately to an entity's size, risk profile and the nature of its services, and certain smaller…
Start this pillar See the whole map
Read against Regulation (EU) 2022/2554 (DORA), Directive (EU) 2022/2555 (NIS2), Commission Delegated Regulation (EU) 2025/301 — RTS on major ICT-related incident reporting on . Regulations and frameworks change; the date is there so you can tell whether this has kept up.