Technical note · Consulting firm
DORA: Technology risks and cybersecurity
DORA extends the perimeter of digital resilience to the whole financial sector and to its critical technology providers.
- Organization
- Management Solutions (MS)
- Document date
- January 2023
- Type
- Technical note
- Language
- Spanish
- Scope
- European Union
- Length
- 9 pages
What it contains
The Management Solutions note (January 2023) explains that the Digital Operational Resilience Act (DORA) again addresses much of the requirements of the EBA guidelines on ICT and outsourcing, adding new requirements or reinforcing some existing ones. It is part of the digital finance package, covers ICT management aspects such as availability and continuity, change management, security and outsourcing, and extends the supervisory perimeter to all financial entities and to third-party ICT service providers, for example cloud providers.
DORA is divided into six domains: perimeter and ICT governance, ICT risks, ICT incident reporting, digital operational resilience testing, ICT third-party risks and information sharing. Among the requirements are an internal governance and control framework, with responsibility of the management body and at least annual review, a three-lines-of-defense model, identification and classification of functions and assets by criticality, a business impact analysis, notification of major incidents to a European hub with a common template and testing of critical systems at least once a year.
On third parties, it extends the scope to every high-risk provider and not only to outsourcing, requires a register of information with all ICT providers, the services they provide and the functions they support, reporting changes to the supervisor once a year, sets guidelines for contracts and the grounds for termination and allows authorities to suspend the use of a service from a critical provider. An annex sets out the challenges and improvement recommendations in technology risk and cybersecurity management.
Why it matters for risk management
It helps to understand the expectations that are becoming widespread on digital resilience, technology third parties and incident reporting. DORA is European Union law and has applied since the beginning of 2025; its impact in the Dominican Republic depends on each institution’s links with the European Union.
No official page for this note was found; the copy that the Club originally published on this site is linked.
Summary prepared by the Dominican Republic Risk Management Club from a reading of the original document, with the source verified on 7 October 2026. It does not replace reading the official text and is not advice.
Connect with our networks