DORA disruption-shock reshapes financial institutions resilience strategies

The arrival of the Digital Operational Resilience Act (DORA) represents a milestone in how financial institutions must approach resilience in an increasingly digital environment. 

The regulation demands not only that firms can withstand ICT- and cyber-related disruptions but that they can respond to, recover from and learn from them. 

During a special session to examine DORA’s wider cross-jurisdiction impact at CeFPro’s Advanced Model Risk Europe conference next spring, practitioners and risk professionals will have the chance to unpack early compliance responses, the obstacles encountered and the strategic shifts required to manage the new regulatory landscape. 

At its heart DORA reframes resilience as a continuous discipline rather than a one-off box-ticking exercise. 

Organisations are being pushed to adopt scenario-based testing, ensure board and senior management accountability, oversee third-party ICT risk and create incident-reporting channels that meet regulatory expectations. 

The session underscored how many firms still struggle with legacy systems, fragmented data, unclear oversight of third-party vendors and insufficient clarity about who owns ICT risk in the business.

Third-party management emerged as a key pain point. Financial firms often rely on suppliers, cloud-services providers and outsourcing relationships without transparent control frameworks or shared incident-recovery plans. 

Under DORA, firms must map and monitor ICT-dependencies, define contractual controls, set escalation pathways and test resilience end-to-end. Without this, compliance becomes superficial and real resilience remains elusive.

Another recurring theme was governance and accountability. Regulators expect clear lines of responsibility, reporting flows from management down to operations, and audit-ready documentation.