1. What is DORA ?
The Digital Operational Resilience Act (DORA) is a new EU law ensuring banks, insurance companies, investment firms, and their technology providers can survive cyberattacks and IT failures. DORA sits alongside NIS2 and GDPR but focuses specifically on keeping your digital services running, even during cyber incidents..
- Think of it as a fitness test for your digital systems.
- DORA became law in January 2023, with full compliance required by January 17, 2025.
- This affects over 22,000 financial businesses across Europe, including Ireland.
What makes DORA different from previous cybersecurity rules is its holistic approach.
- It doesn’t just focus on preventing attacks; it emphasizes resilience your ability to keep operating when things go wrong, recover quickly, and learn from incidents
2. Why 2025-2026 matters ?
January 2025 is the hard deadline. After this, regulators start checking compliance and issuing fines.
Use 2025 to prepare properly.
By 2026, active monitoring begins. Starting now avoids last-minute panic and costs.
3. Why DORA Matters for Irish SMEs and Public Sector
“For many Irish businesses, DORA might seem like yet another compliance burden.”
DORA affects more than just big banks. If you run a fintech startup, handle payments, sell insurance, manage pensions, or provide IT services to financial companies, this law applies to you.
Here’s what’s at stake:
- Fines up to 2% of your yearly revenue or EUR 1 million for individuals
- IT service providers can be fined up to EUR 5 million
- Loss of clients who need compliant partners
- Damage to reputation if you suffer breaches
- Opportunity to stand out as a trusted, secure partner
4. The Five Pillars of DORA
DORA is built on five main pillars. Each one focuses on a different part of keeping your technology safe and working properly.
4.1 Pillar 1: ICT Risk Management
Know what technology you have, what could go wrong, and how to protect it.
Keep a list of important systems, understand risks like hackers or crashes, and have protection plans.
Example:
A payment company lists all systems handling customer payments, identifies threats, then installs security software and backup systems.
No-regret action:
- Start by creating a simple inventory of all your critical IT systems and the data they handle.
- Ask yourself: “If this system went down for 24 hours, what would happen to our business?”
This exercise alone will reveal your true risk exposure.
4.2 Pillar 2: Incident Reporting
When IT problems happen, spot them quickly, understand how serious they are, and report major ones to regulators on time.
Example:
An insurance company discovers a hacking attempt, stops the attack, assesses the damage, and notifies regulators within 4 hours.
No-regret action:
- Establish clear incident response roles today.
- Who notices incidents first?
- Who decides if it’s major?
- Who reports it, and to whom?
- Even a one-page “Incident Response Contact Sheet” can save precious hours during a crisis.
4.3 Pillar 3: Resilience Testing
Regularly test if your defenses work.
Check for system weaknesses, run fake attack scenarios, and ensure you can recover from disasters.
Example:
A pension fund runs virus scans quarterly, tests staff with fake phishing emails yearly, and hires hackers every three years to find weaknesses.
No-regret action:
- Pretend your main system crashed. Walk through what everyone would do and write down gaps in your plans.
4.4 Pillar 4: Third-Party Risk Management
You’re responsible for outside companies you use for cloud storage, software, or IT support.
Check they’re safe and have backup plans if they fail.
Example:
Before using cloud accounting, an investment firm checks vendor security certificates, adds contract protection rules, and keeps offline data copies.
No-regret action:
Email your top ICT service providers and ask these questions:
- What security certifications do you hold?
- What happens if your service goes down?
- Do you have a business continuity plan?
4.5 Pillar 5: Information Sharing
Share information about cyberattacks with other businesses and regulators so everyone can defend better.
Like a neighborhood watch for cybersecurity.
Example:
A credit union spots a new scam email, shares details with an industry security group, and other members block similar emails.
No-regret action:
- Join one free cybersecurity group for your industry to receive weekly threat alerts.
5. How These Five Pillars Improve Your Security
These five pillars work together like layers of protection.
- Risk management shows you where you’re vulnerable before attackers find weaknesses.
- Incident reporting helps you learn from every problem and avoid repeating mistakes.
- Testing proves your defenses actually work under pressure, not just on paper.
- Third-party management protects you from supplier failures that could bring down your business.
- Information sharing gives you early warnings about new threats targeting your industry.
Companies using all five pillars recover from attacks 40-60% faster and successfully block 30-50% more hacking attempts than those with weak defenses.
Pillar | Question | Answer |
Risk Management | Do you have a written list of your critical IT systems with identified risks and protection plans for each one? | Yes/No |
Incident Reporting | If a major IT problem happened right now, does everyone know exactly who to contact and how to report it to regulators? | Yes/No |
Resilience Testing | Have you actually tested how well your systems can recover from failures in the past 12 months? | Yes/No |
Third-Party Risk | Do your contracts with technology suppliers include clear security requirements and backup plans if they fail? | Yes/No |
Information Sharing | Are you actively getting security alerts and threat warnings from any industry group or network? | Yes/No |
5.1 What your answers mean:
0-1 Yes = You need to start preparing urgently.
2-3 Yes = You’ve started but have important gaps to fill.
4-5 Yes = You’re in good shape and ahead of most companies.
6. Conclusion: Start Your DORA Journey Today
- DORA is not just about avoiding fines.
- It’s about protecting your business and customers.
- Companies waiting until late 2024 face rushed implementation and higher costs.
- Those starting now have time to build strong defenses properly.
- Start with the simple no-regret actions listed above.
- These cost little but show you where you stand and what needs fixing first.
Need help turning GDPR & DORA into a clear action plan?
If this article resonated with challenges inside your organisation, let’s map your current controls and build a pragmatic, risk‑based roadmap for the next 90 days.