DORA sets requirements for the financial sector's digital resilience. Are your IT suppliers ready?
Banks, insurance companies, and investment firms must manage ICT risks, report incidents, and oversee their third-party providers. If you deliver IT services to the financial sector, your customers will demand the same from you.
Five pillars for digital resilience
DORA is built on five pillars. Each pillar has specific requirements, with AmpliFlow tools that support the work.
ICT risk management
Financial entities need a documented framework for identifying, assessing, and managing ICT risks. The framework must be reviewed annually and approved by management.
ICT incident reporting
Major ICT incidents must be classified and reported in three stages: initial notification within 4 hours of classification (maximum 24 hours after detection), intermediate report within 72 hours, and final report within one month. This requires processes for capturing, categorising, and escalating.
Resilience testing
Annual basic testing of ICT systems for all entities. Significant entities must also conduct Threat-Led Penetration Testing (TLPT) every three years.
Third-party risk management
Complete register of all ICT third-party providers. Risk assessment, concentration risk analysis, and documented exit strategies.
Information sharing
Voluntary arrangements for sharing threat information between financial entities. Strengthens the collective resilience of the sector.
Financial institutions must manage their ICT suppliers. That affects you.
DORA requires banks and insurance companies to maintain registers of all ICT third-party providers, assess concentration risks, and have documented exit strategies. If you sell software or IT services to the financial sector, your customers will require you to demonstrate security controls, incident handling processes, and documented risk management.
Regulated by DORA
Bank / Insurance company
Sets requirements for
ICT supplier
Must demonstrate
Documented governance
Supplier register
Your customers must maintain a register of all ICT third-party providers with risk assessments, contract information, and dependencies.
Concentration risk
Financial entities must assess whether they are too dependent on a single ICT supplier. You need to demonstrate that you mitigate that risk.
Exit strategies
Your customers must have documented exit strategies for all critical ICT suppliers. This affects how you structure your services.
Security controls
You need to demonstrate how you handle incidents, assess risks, and protect data, in a structured and documented way.
DORA and NIS2: not the same thing
DORA and NIS2 overlap partially, but they differ in scope, detail, and legal status. DORA takes precedence for financial entities.
| Aspect | DORA | NIS2 |
|---|---|---|
| Type | Regulation (directly applicable) | Directive, transposed in Sweden as the Cybersecurity Act (cybersäkerhetslagen, SFS 2025:1506) |
| Scope | Financial sector: banks, insurance, securities, crypto | Broad sectors: energy, transport, health, digital infrastructure |
| Focus | Digital operational resilience and ICT risks | Overall cybersecurity and network security |
| Third parties | Detailed requirements: ICT provider register, concentration risk, exit strategies | Basic supply chain security requirements |
| Testing | Mandatory TLPT every three years for significant entities | No specific testing requirements |
| Relation | Lex specialis: takes precedence for financial entities | General legislation: the Cybersecurity Act (cybersäkerhetslagen, SFS 2025:1506) explicitly excludes DORA-covered financial entities (1 kap. 10 §) |
How AmpliFlow supports each pillar
AmpliFlow handles organisational governance, not technical security solutions. Here are concrete tools mapped to DORA's pillars.
Risk assessment with risk matrices
Assess ICT risks by likelihood and impact. Link risks to assets and actions. If you already work with ISO 27001, you have a foundation for DORA compliance.
Pages (wiki) for ICT policies
Centralise framework documentation, policies, and procedures in AmpliFlow's wiki feature. Management can review and comment directly in the system.
Incident management via deviations
Register ICT incidents with classification and prioritisation. Workflow for root cause analysis, action, and verification. Full traceability for reporting to supervisory authorities.
Audit planning and follow-up
Plan and schedule testing activities and reviews of ICT processes. Document findings, deviations, and improvement actions.
Supplier register
Register of ICT third-party providers with contact information. Document dependencies and exit strategies in Pages (wiki). Risk assessments are handled separately in the risk module.
Process management and continuity
Map business-critical processes and their dependencies on ICT systems and third-party providers. Document continuity plans in Pages (wiki), use checklists for exercises.
Questions about DORA and AmpliFlow
What is DORA?
Who must comply?
Do all requirements apply to everyone?
How does DORA differ from NIS2 and the Cybersecurity Act?
What does DORA mean for ICT suppliers?
How does AmpliFlow support DORA compliance?
How does ISO 27001 help with DORA?
Want to see how it works?
Book a demo and we'll show you how AmpliFlow can support your DORA work, whether you're a financial entity or an ICT supplier to the financial sector.