DORA has applied to around 22,000 EU financial entities since 17 January 2025. UK firms are caught through EU subsidiaries, branches and the services they provide into the EU, not through UK law.
What is DORA?
The Digital Operational Resilience Act, Regulation (EU) 2022/2554, has applied since 17 January 2025. It replaced a patchwork of national guidance with one directly applicable rulebook covering how financial entities manage ICT risk, and it reaches roughly 22,000 firms across twenty entity types, from banks and insurers to crypto-asset service providers.
DORA is built on five pillars: ICT risk management, incident reporting, resilience testing, third-party risk, and information sharing. Four are mandatory. The fourth is the one that changes behaviour most, because it makes your suppliers your regulatory problem and requires a register of information on every contractual arrangement.
A UK firm with no EU presence is not in scope. A UK firm with an EU subsidiary, an EU branch, or EU clients very likely is, and that is the question worth answering first. DORA also reaches ICT providers themselves: those designated critical are supervised directly by the European Supervisory Authorities.
Compliance requirements
Four of the five carry obligations. Information sharing is voluntary, and is the only pillar you can decline.
A documented ICT risk management framework owned by the management body, covering identification, protection, detection, response and recovery. The management body carries the accountability personally and cannot delegate it away.
Classify ICT-related incidents against defined criteria and report major ones to your competent authority on the prescribed timetable, with initial, intermediate and final reports.
A risk-based testing programme across all critical systems. Significant entities also face threat-led penetration testing, carried out at least every three years.
A register of information on every contractual arrangement, mandatory contract terms, concentration risk analysis, and documented exit strategies for critical providers.
Voluntary arrangements for exchanging cyber threat intelligence with other financial entities. The only pillar that is not mandatory.
Audit process
Netru manages the complete CAF compliance journey, from determining applicability through to competent authority submission and ongoing improvement.
We confirm which of your entities fall in scope, which of the twenty financial entity types each one is, and whether the proportionality regime for smaller entities applies.
We assess your current position against all five pillars and the underlying regulatory technical standards, producing a prioritised remediation plan.
We build the register of information on contractual arrangements in the format supervisors expect. This is the deliverable most firms underestimate.
Your compliance manager implements the ICT risk management framework, incident classification process and third-party controls, with evidence collected throughout.
We design the resilience testing programme and, where threat-led penetration testing applies, scope and manage it.
We prepare your reporting templates and supporting evidence, and support you through supervisory engagement.
How Netru delivers it
Our UK-based team has deep experience in the NCSC CAF and NIS Regulations compliance. We assess your posture against all CAF objectives, implement improvements, complete your self-assessment, and manage the competent authority submission process.
Talk to our teamBefore you talk to anyone