The Digital Operational Resilience Act (DORA), Regulation (EU) 2022/2554, sets uniform requirements for the security of the network and information systems that support financial entities in the EU. Because it is a regulation, it applies directly in all Member States. It covers banks, insurers, investment firms, payment institutions, crypto-asset service providers and others.

Key requirements

• ICT risk management: a documented framework to identify, protect, detect, respond to and recover from ICT risks, owned by the management body.
• Incident reporting: major ICT-related incidents must be classified and reported to the competent authority.
• Resilience testing: regular testing, and for significant entities, threat-led penetration testing (TLPT) based on realistic attack scenarios.
• Third-party risk: contracts, registers and exit plans for ICT providers, with direct EU oversight of critical ICT third-party providers.
• Information sharing: voluntary exchange of cyber threat intelligence between financial entities.

Why it matters for dark web monitoring

DORA expects financial entities to know their threats and detect incidents early. Stolen customer and employee credentials, leaked internal data and fraud kits that target a bank’s customers often appear in criminal sources first. Threat intelligence from those sources also feeds TLPT scenarios and third-party risk reviews, both central to the regulation.

Sources: EUR-Lex: Regulation (EU) 2022/2554 (DORA), EIOPA: Digital Operational Resilience Act (DORA)