The Digital Operational Resilience Act (DORA) has been in effect for over two months (since 17th January 2025, with the previous two years for preparation), but some organizations are still unprepared. While this regulation directly affects the financial sector of the European Union (EU), it also impacts US companies providing services to EU financial firms, including US firms providing services to their EU subsidiaries.
This is perhaps the most significant yet underrated aspect of DORA. Not only does DORA mandate higher resilience standards of EU financial institutions, but it also requires the management of third-party risk, similar to DoD CMMC, but with even more depth and detail. This means European financial institutions must be wary of third-party vendors and partners they work with, while U.S. companies that want to do business these firms must be compliant and be prepared for audits. These audits include the ability to upload metrics and data, in a Register of Information, regarding their third parties.
