A financial customer needs evidence that its ICT service is managed. What to agree in the contract and how to test recovery and incident communication.
DORA is the EU regulation on digital operational resilience for financial entities. It has applied since 17 January 2025. The duties land directly on banks and insurers, on investment firms and on the other financial entities that the regulation covers, and they split into four areas.
A supplier is not automatically the direct addressee of every DORA duty. Its financial customer, though, must be able to show how it selected the service and how it manages that service in a risk-proportionate way, and the contract it signed with you is part of that evidence.
For a critical or important function the list of questions gets longer. Due diligence and the contract can reach for any of this.
The scope depends on the service and the risk.
ISO 27001 can be useful evidence. On its own it is not a blanket statutory DORA requirement.
A financial entity must plan and perform risk-proportionate digital-resilience testing. TLPT is a specific supervisory regime for selected entities and not a routine obligation for every supplier.
A supplier should have a contractual process for promptly giving the customer information needed for its incident response and reporting.
Run two useful exercises. Restore a representative record from backup and record the actual recovery time. Then simulate an incident notification and confirm the customer learns the impact and the affected service within the agreed period along with containment and the next update.
These exercises support a customer assessment. They do not replace legal advice or a regulator’s decision.
Read the primary text in DORA on EUR-Lex. See custom software and technology consulting for a delivery brief.
If you are preparing a service for a regulated customer, contact us. We can turn customer requirements into clear technical and contractual material.
Founder and CEO of Rise.sk. He designs and delivers web applications, data systems, and automation, and writes about software decisions, AI, and digital services.
Your enterprise clients will start sending NIS2 compliance questionnaires. Here's what software companies need to know about security baselines, incident response, and supply chain obligations.
AI Act transparency rules apply from August 2, 2026. High-risk employment AI rules apply from December 2, 2027. Practical preparation guide.
Slovak Act 76/2026 is in force and the first report has a transitional period. Separate domestic rules from the Directive and prepare traceable HR data.
