DORA explained: impact on Software procurement in the financial sector
DORA takes effect on 17 January 2025 and fundamentally changes how financial organisations procure and contract Software. Here’s what you need to know about the five pillars, the contractual requirements, and the impact on managing Software vendors.
- September 9, 2025
- 5 min
- DORA – Digital Operational Resilience Act
DORA, the Digital Operational Resilience Act, has been in force across the entire EU since 17 January 2025. For financial organisations, digital resilience is therefore no longer just an internal IT issue but a legal obligation subject to supervision.
What is DORA?
DORA is an EU regulation and thus applies directly, without being transposed into national law. The regulation applies to a wide range of financial entities, from banks and insurers to investment firms, payment institutions, and crypto service providers.
The five pillars
ICT risk management: a framework to identify, classify, and control ICT risks.
Incident reporting: major ICT incidents must be reported within strict timeframes.
Testing digital resilience: periodic tests of critical systems.
Management of ICT third-party risks: contractual requirements, a register, and analysis of concentration risk.
Information sharing: sharing threat information within the sector.
What does DORA mean for Software procurement?
The fourth pillar directly affects Software procurement:
Contractual minimum requirements: ICT contracts must include provisions covering, among other things, service delivery, incident reporting, audit rights, exit clauses, data location, and continuity.
Register of Information: an up-to-date and complete register of all contractual agreements with ICT service providers.
Concentration risk: excessive dependence on a single party must be assessed.
Subcontractors: the parties your Software vendors rely on must also be mapped.
Read in DORA in practice what supervisors are currently focusing on.
How SoftVaro helps
SoftVaro maps your Software landscape, including the long tail often missing from the register. At each renewal, we incorporate the contractual provisions required by DORA. This article is not legal advice; please coordinate its application with your compliance or legal department.
Frequently Asked Questions
The most asked questions about this topic.
Who does DORA apply to?
DORA applies to a broad range of financial entities in the EU, including banks, insurers, investment firms, payment institutions, and crypto service providers. ICT service providers encounter DORA requirements through their contracts with these clients.
Does DORA also apply to my Software Vendor?
Indirectly, yes. Your organisation must contractually record the DORA requirements with the Software vendors you use. Providers designated as critical are also subject to direct European supervision.
What are the sanctions for non-compliance with DORA?
Sanctions for financial entities are determined by national supervisors. For critical ICT service providers, the European supervisor has its own enforcement powers.
Ready to save on software?
SoftVaro negotiates the best deal on your behalf with over 4,000 suppliers. Independent, transparent, within 24 hours.