In brief
- Regulation: DORA.
- Insurance and reinsurance companies are financial entities covered by DORA.
- ICT risk management framework.
- Incident management and notification.
- Resilience tests.
- DORA falls under a prudential framework: authorities have powers of supervision, injunction and sanction.
Regulatory deadlines
The key dates of this regulation.
January 2023
Entry into force
In forceJanuary 2025
Application
In forceWhat does DORA cover?
DORA harmonises the digital operational resilience requirements of the European financial sector, including insurance. It rests on five pillars: ICT risk management, incident management and reporting, resilience testing, third-party ICT provider risk management, and cyber threat information sharing.
A proportionality principle applies, with a simplified framework for certain small, non-interconnected entities.
Is the 'Insurance' sector affected?
Insurance and reinsurance companies are financial entities covered by DORA. The regulation covers all their information systems and their relationships with ICT third-party providers.
Proportionality modulates the intensity of obligations, but the framework applies to all insurers.
Detailed obligations
ICT risk management framework
Document ICT risk management strategies and policies, identify critical functions, and cover protection, detection, response and recovery, under the responsibility of management.
Incident management and notification
Classify ICT incidents and notify major incidents to the competent authorities within the prescribed timeframes and formats.
Resilience testing
Implement a testing programme and, for significant entities, threat-led penetration testing (TLPT).
ICT provider risks.
Maintain an information register, govern contracts (audit, reversibility, sub-contracting, location) and monitor concentration.
Information sharing
Participate, where applicable, in cyber threat information-sharing schemes.
Sanctions & risks
DORA falls under a prudential supervisory regime: authorities hold powers of supervision, injunction, and sanction. ICT providers designated as critical may be subject to periodic penalty payments of up to 1% of their average daily worldwide turnover.
A resilience failure exposes the organisation to supervisory measures and a major reputational and prudential risk.
Application timeline
- 1Application. DORA has been applicable since 17 January 2025.
- 2Information register. Periodic reporting of the ICT third-party provider register to authorities.
Common mistakes in the sector
- 1Confusion with NIS2. Duplicating measures when DORA prevails for ICT risk.
- 2Incomplete register. Failing to exhaustively inventory ICT service providers and subcontracting.
- 3Theoretical tests. Having an untested testing programme.
- 4Absent governance. Treating DORA as a purely technical matter.
Practical case
An insurer identifies a heavy dependency on a cloud provider for contract management. Under DORA, it documents this concentration risk, strengthens reversibility and audit rights, registers the provider in its information register, and integrates it into its resilience testing programme.
Compliance roadmap
- 1
Structuring the ICT framework. Formalise ICT risk strategy, policies and governance.
- 2
Tooling incidents. Implement classification and notification of major incidents.
- 3
Schedule testing. Define a testing programme and, if significant, prepare for TLPT.
- 4
Maintain the register. Build the information register and frame supplier contracts.
- 5
Govern. Have the governing body own the framework.
Frequently asked questions
Yes, as financial entities, with a proportionality principle and a simplified framework for certain small non-interconnected entities.
Take action on DORA
Free assessment or a chat with an expert dedicated to insurance.
They already trust us
See how organisations in the insurance sector secured their compliance with DCO.