Framework hub

DORA

DORA applies to EU financial entities and their ICT third-party providers, including cloud, SaaS, data analytics, and security vendors.

EU baseline

If you are established in the EU, operate in the EU, or place this product or service on the EU market, treat this as a first-order compliance check. Non-EU reach language means outsiders can also be covered, not that EU companies are outside scope.

Review scope

Focus 1

ICT risk management

Articles 5-15 cover governance, risk controls, protection, detection, and recovery.

Focus 2

Incident reporting

Articles 17-23 cover ICT-related incident classification and reporting.

Focus 3

Resilience testing

Articles 24-27 cover testing and threat-led penetration testing.

Focus 4

Third-party ICT risk

Articles 28-44 cover provider oversight and contractual controls.

Focus 5

Luxembourg CSSF layer

CSSF circulars are tracked for Luxembourg financial entities.

Open related page

Source updates

MEDIUMFederal Register2026-08-07

Pacific Fishery Management Council; Public Meeting

The Pacific Fishery Management Council (Pacific Council) will hold an online meeting of its Ad Hoc Highly Migratory Species (HMS) Fisheries Innovation Workgroup (FIW) to discuss procedures...

US federal regulationDORA
HIGHFederal Register2026-08-07

Personnel Appeals Board; Procedural Rules

The Government Accountability Office Personnel Appeals Board (PAB or Board) proposes several significant changes to its existing regulations to streamline and modernize case processing...

US federal regulationDORA
LOWFederal Register2026-08-07

Ohio Regulatory Program

The Office of Surface Mining Reclamation and Enforcement (OSM), is approving, in part, two amendments to the Ohio regulatory program (the Ohio program) under the Surface Mining Control and...

US federal regulationDORA