DORA (Digital Operational Resilience Act)
The European regulation imposing digital operational resilience requirements on financial entities, including toward their providers.
Regulation (EU) 2022/2554 of December 14, 2022, known as DORA (the Digital Operational Resilience Act), has applied since January 17, 2025 and aims to strengthen the digital operational resilience of the financial sector, banks, insurers, asset managers and associated providers. It harmonizes requirements for managing information-technology risk, imposing a framework that covers IT-risk governance, incident detection and management, incident reporting to authorities, resilience testing, including advanced penetration testing, and above all the control of risk linked to critical third-party providers. This last component is particularly notable, since DORA for the first time places large IT service providers, notably cloud providers, under direct oversight when deemed critical to the financial system. For insurance and risk management, DORA is doubly relevant, it creates obligations whose breach constitutes a regulatory exposure, and it explicitly recognizes the concentration risk on infrastructure providers that lies at the heart of cyber accumulation issues. It dovetails with other texts such as the GDPR and the NIS2 directive, whose application to the financial sector it refines.
Since January 2025, a French life insurer applies DORA. In practice, it has mapped its forty-two IT providers and identified two critical cloud providers: AWS hosting its policy-management system and Microsoft Azure carrying its messaging and collaborative tools. It conducted an advanced penetration test (TIBER-EU) on its pricing infrastructure and documented a continuity plan for AWS unavailability. In March 2025, a security incident at a data-processing sub-contractor is notified to the ACPR within four hours of its classification as a major incident, and no later than twenty-four hours after detection, as Delegated Regulation (EU) 2025/301 requires. Failure to report would have exposed the company to administrative sanctions, and its executives to the measures provided under national law.
Follow the research
One letter a week. First, the week's underwriting note, when one is published: a dated, argued decision, signed by Paul Bernardski. Then what the observatory published on cyber risk, political risk and insurance. No account, no tracking.
No spam, one-click unsubscribe, no data ever sold.