DORA
DORA is the EU regulation (2022/2554) on digital operational resilience for the financial sector. It sets rules for ICT risk management, incident reporting, resilience testing, and third-party ICT risk, and has applied since 17 January 2025.
Digital Operational Resilience Act
What you get with DORA.
- DORA available as a prebuilt framework
- 98 requirements tracked with status and evidence
- Vendor and risk records kept in the same platform
Running DORA in Varman
Digital Operational Resilience Act is available in Varman as a prebuilt framework. The numbers below are what it contains in the product today. You add it to your workspace and work through it in the same place as your policies, risks, vendors, and evidence.
- 98
- requirements
- 45
- controls mapped
- 34
- evidence tasks
- 28
- policy templates
1. Add the framework
Each DORA requirement appears with its status, so you can see what is met and what is still open.
2. Connect your systems
Integrations run scheduled checks against your cloud, identity, and developer tools and record the results as evidence. See the integrations.
3. Close the gaps
Policies, tasks, and uploaded evidence cover what cannot be checked automatically. Readiness for DORA updates as each item is completed.
4. Work with your auditor
Varman organizes the evidence. Any audit, assessment, or certification is carried out by an independent third party, not by Varman.
DORA questions, answered.
When did DORA start to apply?
DORA, Regulation (EU) 2022/2554, entered into force in January 2023 and has applied since 17 January 2025. As a regulation, it applies directly in every member state without national transposition.
Who does DORA apply to?
Financial entities in the EU, such as credit institutions, payment and e-money institutions, investment firms, crypto-asset service providers, insurers, and fund managers. ICT third-party service providers designated as critical are overseen directly by the European Supervisory Authorities.
What are the DORA incident reporting deadlines?
For a major ICT-related incident, the initial notification is due within 4 hours of classifying it as major and no later than 24 hours after becoming aware of it. An intermediate report follows within 72 hours of the initial notification, and a final report within one month of the latest intermediate report.
How does Varman help with DORA?
Varman ships DORA as a prebuilt framework with 98 requirements, 45 mapped controls, 34 evidence tasks, and 28 policy templates. Integrations collect evidence automatically, and any audit or certification is done by an independent third party.