1. DORA Enforcement Reality for FinTechs and Critical ICT Suppliers
Regulation (EU) 2022/2554 on Digital Operational Resilience for the Financial Sector (DORA) applies not only to regulated financial institutions, payment processors, and investment firms, but also cascades contractually under Article 30 to B2B SaaS, cloud, and data analytics suppliers serving those entities.
When a European financial institution audits an ICT supplier under DORA Article 30, it requires contractual right-to-audit provisions, documented exit and migration blueprints, sub-outsourcing visibility across the fourth-party chain, and structured data ready for the institution's Register of Information.
| Statutory / Procurement Source | Observed Vendor Deficiency | Regulatory / Commercial Consequence | Engineered DORA Architecture (BPS-DOR-01) |
|---|---|---|---|
| Commission Implementing Regulation (EU) 2024/2956 | Flat Excel vendor list lacking relational LEI/EUID keys across templates B_01.01 to B_99.01 | Rejected by EU Financial Entity TPRM Desk | 15-table relational Register of Information workbook with entity-to-function foreign keys |
| Commission Delegated Regulation (EU) 2025/301 & NIS2 | Single generic incident plan conflating DORA Competent Authority and NIS2 CSIRT timelines | Statutory Reporting Non-Compliance | Dual-track runbook: DORA (4h/24h initial, 72h intermediate, 1mo final) vs. NIS2 (24h/72h/1mo) |
| DORA Art. 28-30 Critical ICT Provider Contract Audits | Missing documented exit strategies, concentration risk scoring, and 4th-party LLM lineage | 4.2x Slower Banking Onboarding | Pre-populated Art. 30 contractual addendum matrix and Multi-AZ / subprocessor exit playbook |
2. DORA Articles 5 to 16: ICT Risk Management Framework vs. ISO 27001
While ISO/IEC 27001:2022 focuses on confidentiality, integrity, and availability of information assets, DORA Articles 5 through 16 prioritize continuous operational continuity of critical or important functions (CIFs). Management bodies carry direct statutory accountability under DORA Article 5(2) and NIS2 Article 20 to approve the ICT risk strategy and review digital resilience testing.
Our DORA & NIS2 Extension upgrades an ISO/IEC 27001 ISMS by adding the statutory clauses, governance charters, and CIF dependency mappings required by European supervisory authorities.
| Regulatory Pillar | Legal Reference | Baseline ISO 27001 Coverage | Mandatory DORA / NIS2 Blueprint Extension |
|---|---|---|---|
| Management Body Accountability | DORA Art. 5 / NIS2 Art. 20 | Partial (Clause 5.1 Leadership) | Board ICT Liability Charter & Annual Training Attestation |
| ICT Risk & Resilience Strategy | DORA Art. 6 to 16 | Partial (Clauses 6, 8 & Annex A.8) | Dedicated ICT Risk Framework & Digital Operational Resilience Strategy |
| Major ICT Incident Reporting | DORA Art. 19 / NIS2 Art. 23 | Partial (A.5.24-A.5.28) | Dual-Regime Playbook: DORA Competent Authority (4h/24h, 72h, 1mo) vs. NIS2 CSIRT (24h, 72h, 1mo) |
| Resilience Testing & TLPT | DORA Art. 24 to 27 | Partial (A.8.8 Vulnerability Mgmt) | Annual ICT Testing Programme & Threat-Led Penetration Testing Scope |
| ICT Third-Party Register & Exit | DORA Art. 28-30 & Reg. 2024/2956 | Partial (A.5.19-A.5.23) | 15-Table Register of Information (B_01.01 to B_99.01) & Stressed Exit Plans |
3. Engineering the Article 28(3) Register of Information (Templates B_01.01 to B_99.01)
A high-friction requirement under DORA is the Article 28(3) Register of Information. Commission Implementing Regulation (EU) 2024/2956 mandates a relational workbook of fifteen interconnected tables coded B_01.01 through B_99.01 (formerly draft RT.01.01 to RT.99.01) tracking entity identifiers (LEI codes), contractual arrangements, critical function mappings, supply-chain ranks, and substitutability assessments. Our architecture delivers a structured Excel workbook modeled on the final official B_01.01 to B_99.01 schema.
4. Distinguishing DORA Competent Authority Reporting from NIS2 CSIRT Timelines
Auditors routinely verify that incident response plans do not conflate DORA and NIS2 reporting authorities or clocks. Under DORA Article 19 RTS, regulated financial entities submit initial notification of a major ICT-related incident to their financial Competent Authority within 4 hours of classification (and no later than 24 hours from detection), followed by an intermediate report within 72 hours and a final report within one month. Under Directive (EU) 2022/2555 (NIS2) Article 23, Essential and Important Entities submit an early warning to the national CSIRT or competent authority within 24 hours, an incident notification within 72 hours, and a final report within one month. Our Incident Response Runbook provides separate, explicit decision trees for both regimes.