Luca BertonDORA (Regulation 2022/2554) applies to virtually every financial entity in the EU — banks, insurers, investment firms, payment providers, and their critical ICT third-party providers. It's been applicable since January 2025, and supervisory scrutiny is intensifying. The question isn't whether you comply. It's whether your infrastructure actually delivers the resilience DORA demands.
What DORA Actually Requires
DORA isn't a checklist. It's five interconnected pillars, each with infrastructure implications:
- ICT Risk Management (Articles 5-16) — Identify, protect, detect, respond, recover across all ICT systems
- ICT Incident Reporting (Articles 17-23) — Classify, report, and learn from ICT-related incidents
- Digital Operational Resilience Testing (Articles 24-27) — Test your infrastructure regularly, including threat-led penetration testing (TLPT)
- ICT Third-Party Risk (Articles 28-44) — Manage concentration risk and ensure vendor resilience
- Information Sharing (Article 45) — Participate in threat intelligence sharing arrangements
Infrastructure Engineering Response
Each pillar translates into concrete infrastructure capabilities:
- Risk Management → Asset inventory automation, vulnerability scanning, configuration management, encryption enforcement
- Incident Reporting → SIEM, automated classification, regulatory reporting pipeline, forensic data preservation
- Resilience Testing → Chaos engineering platform, red team infrastructure, automated recovery testing
- Third-Party Risk → Vendor monitoring, exit strategy infrastructure, multi-cloud portability
- Information Sharing → Threat intelligence platform integration, STIX/TAXII feeds
Kubernetes Recipes
Practical guide for container orchestration and deployment — hands-on patterns you can use today.
View on Amazon →Why This Is an Infrastructure Problem
Most financial institutions treat DORA as a GRC (governance, risk, compliance) exercise — documents, policies, committees. But DORA is fundamentally about operational resilience. You can't document your way to resilience. You build infrastructure that is resilient, test it, and prove it works. That's engineering, not compliance.