DORA in Practice: Early Lessons from Financial Sector Implementation

The DORA Implementation Reality

Six months after DORA's full application on 17 January 2025, the financial sector's implementation experience is revealing practical challenges that theoretical compliance analysis didn't fully anticipate. Supervisory authorities are conducting initial assessments, and regulated entities are discovering gaps between compliance documentation and operational readiness.

Most Common Implementation Challenges

ICT Asset Inventory Completeness

DORA requires comprehensive asset identification. Early assessments consistently find that ICT asset inventories are less complete than organisations believed — particularly for cloud resources, shadow IT, and the long tail of SaaS applications deployed across business units without central IT involvement.

A financial institution that believed it had 150 SaaS applications in scope may discover 400+ after systematic discovery work. Each application requires assessment for ICT risk profile, dependency on critical functions, and third-party risk implications.

Incident Classification Accuracy

DORA's mandatory incident reporting requirements apply to "major ICT-related incidents" — a defined category based on financial impact thresholds, client numbers affected, duration, and geographic spread. Early implementation reveals significant uncertainty in applying these criteria to specific incidents.

Common problems: organisations that classify incidents as not major based on initial assessments before full impact is known; organisations without established processes to consistently apply classification criteria across different incident types.

Third-Party Contract Remediation Pace

All ICT third-party service providers supporting critical functions must have contractual arrangements meeting DORA requirements. The remediation timeline for large third-party portfolios has proven more challenging than anticipated.

Challenges include: identifying which providers fall in scope (requiring ICT function mapping), negotiating amendments with large technology suppliers who prefer standard terms, and managing the volume of simultaneous contract amendments.

TLPT Programme Development

Threat-Led Penetration Testing is mandatory for significant institutions every three years following the TIBER-EU framework. Many institutions are working through TLPT requirements for the first time, discovering significant lead time requirements.

The pool of TIBER-certified test providers is limited, with lead times commensurate with market capacity. Institutions that haven't engaged test providers are finding limited availability.

What's Working Well

Digital Operational Resilience Testing programmes that frame testing as a continuous capability rather than a compliance exercise are building more genuine resilience and producing better audit evidence.

ICT risk management framework integration with existing enterprise risk management — rather than treating DORA as a separate parallel structure — is proving more sustainable.

Proactive regulatory engagement demonstrating good-faith progress is resulting in more pragmatic supervisory responses than organisations that adopt a defensive posture.

Looking Forward

DORA implementation is a multi-year programme. The organisations best positioned at their first full supervisory assessment are those treating DORA compliance as embedding genuine operational resilience capability — continuously improving their ICT risk management, testing, and third-party oversight rather than achieving a minimum compliance baseline and maintaining it.