What is DORA for fintech?

The five areas

1. 1ICT risk management: a governed framework for identifying, protecting, detecting, responding to and recovering from ICT risks.
2. 2Incident management and reporting: classify ICT incidents and report major ones to the competent authority.
3. 3Resilience testing: a testing programme, and for some larger firms threat-led penetration testing at least every 3 years.
4. 4ICT third-party risk: a register of all contracts for ICT services, required contract terms and exit strategies.
5. 5Information sharing on cyber threats between financial entities.

What it means if you build software for a financial firm

A software or cloud supplier to an EU financial entity becomes an ICT third-party service provider. Article 30 lists what the contract must include, such as a full description of the services, where data is processed and stored, data protection, access and return of data, service levels, incident help, cooperation with authorities, and termination rights.

Expect your clients to ask for these terms, for audit and access rights, and for help with their testing and exit plans. Separately, the European Supervisory Authorities designate a small number of critical ICT providers for direct EU oversight.

What it means for the product

Build for evidence and recovery: maker-checker controls on risky actions, audit logs, monitoring and alerting, tested backups with clear recovery targets, incident runbooks, and a clean way to export data if the client leaves.