The Five Pillars of DORA: Core Requirements Explained

Understanding these five pillars is essential for planning your compliance approach. While they are distinct areas, they reinforce each other. Effective incident reporting depends on robust detection capabilities; resilience testing validates your risk management framework; and third-party oversight requires understanding your own ICT landscape first.

Key Takeaways

Quick Answer: DORA requires financial entities to implement measures across five pillars: ICT risk management (governance and controls), incident reporting (detection and notification), resilience testing (vulnerability assessments and penetration testing), third-party risk management (vendor oversight and contracts), and information sharing (threat intelligence exchange). All five pillars must be addressed, though proportionately to your organization's size and complexity.

The five pillars of DORA are:

1. ICT Risk Management
2. ICT Incident Reporting
3. Digital Operational Resilience Testing
4. ICT Third-Party Risk Management
5. Information Sharing

Pillar 1: ICT Risk Management

The foundation of DORA compliance is a comprehensive ICT risk management framework. This goes beyond traditional information security to encompass the full lifecycle of identifying, protecting against, detecting, responding to, and recovering from ICT-related disruptions.

Core Requirements

Management Accountability

DORA places direct responsibility on the management body (board of directors or equivalent). Senior leadership must:

• Define, approve, and oversee the ICT risk management framework
• Ensure adequate ICT budget and resources
• Approve arrangements for ICT services supporting critical functions
• Undergo regular training to understand ICT risks
• Review and approve ICT-related policies

This represents a significant shift from treating ICT risk as a purely technical matter delegated to IT departments.

For detailed guidance, see our ICT Risk Management article.

Pillar 2: ICT Incident Reporting

DORA establishes a harmonized incident reporting framework that requires financial entities to detect, classify, and report major ICT-related incidents within strict timelines.

Incident Classification

Financial entities must classify ICT-related incidents based on criteria including:

Reporting Timeline

Major incidents must be reported in three stages:

Client Notification

When a major incident affects client financial interests, entities must inform affected clients without undue delay, including measures clients can take to mitigate the impact.

For detailed guidance, see our Incident Reporting article.

Pillar 3: Digital Operational Resilience Testing

DORA mandates regular testing to validate that ICT systems and processes can withstand disruptions. Testing requirements scale with entity size and systemic importance.

Testing Requirements by Entity Type

Threat-Led Penetration Testing (TLPT)

TLPT is an intelligence-driven form of testing that simulates real-world attack scenarios:

• Scope: Live production systems supporting critical functions
• Methodology: Red team exercises based on current threat intelligence
• Third-party inclusion: ICT providers supporting critical functions must participate
• Frequency: At least every 3 years for designated entities
• External requirement: Every third TLPT must use external testers

TLPT differs from traditional penetration testing in its scope (entire organization vs. specific systems) and approach (threat intelligence-driven vs. vulnerability scanning).

For detailed guidance, see our Resilience Testing article.

Pillar 4: ICT Third-Party Risk Management

Recognizing that financial sector resilience depends on technology supply chains, DORA establishes comprehensive requirements for managing ICT third-party providers.

Key Requirements

Register of Information (RoI)

Financial entities must maintain a register documenting all ICT third-party arrangements. This register serves as:

• Internal monitoring tool for ICT third-party risk
• Information source for supervisory authorities
• Input for designation of Critical ICT Third-Party Providers

The RoI must be submitted to regulators, with first submissions due in 2025/2026.

Critical ICT Third-Party Providers

Providers designated as critical face direct EU oversight through Joint Examination Teams. Designation criteria include systemic importance, concentration risk, and potential impact on financial stability.

For detailed guidance, see our Third-Party Risk Management article.

Pillar 5: Information and Intelligence Sharing

DORA's fifth pillar encourages (but does not mandate) financial entities to share cyber threat intelligence and information about ICT-related incidents.

Voluntary Framework

Benefits

Information sharing helps financial entities:

• Identify emerging threats earlier
• Learn from incidents affecting peers
• Improve collective defense capabilities
• Reduce duplication of threat analysis efforts

Regulatory Notification

Financial entities participating in information-sharing arrangements must notify their competent authority. Supervisory authorities may themselves share relevant cyber threat information with financial entities.

For detailed guidance, see our Information Sharing article.

How the Pillars Work Together

The five pillars form an integrated approach to digital operational resilience:

1ICT Risk Management (Pillar 1)
2        ↓
3    Identifies risks and establishes controls
4        ↓
5Resilience Testing (Pillar 3) ←→ Third-Party Risk (Pillar 4)
6        ↓                              ↓
7    Validates controls           Extends to supply chain
8        ↓                              ↓
9Incident Reporting (Pillar 2)
10        ↓
11    Captures lessons learned
12        ↓
13Information Sharing (Pillar 5)
14        ↓
15    Improves collective resilience

An incident discovered through monitoring (Pillar 1) triggers reporting obligations (Pillar 2). Testing (Pillar 3) may reveal control gaps that need to be addressed. Third-party oversight (Pillar 4) ensures your supply chain does not undermine your resilience. Information sharing (Pillar 5) enables the sector to learn collectively.

Implementation Priorities

For most financial entities, we recommend addressing the pillars in this order:

However, specific priorities may vary based on your current maturity and gaps.

Common Questions

Are all five pillars mandatory?

The first four pillars (ICT risk management, incident reporting, resilience testing, and third-party risk management) are mandatory. Information sharing (Pillar 5) is voluntary but encouraged.

Can we address pillars sequentially?

While the pillars are interconnected, you can prioritize based on gaps and deadlines. ICT risk management is foundational and should come first. Incident reporting must be in place from day one. The Register of Information has specific submission deadlines.

How do the pillars relate to ISO 27001?

ISO 27001 provides good coverage for Pillars 1 and 4, and partial coverage for Pillars 2 and 3. However, DORA has specific requirements that go beyond ISO 27001, particularly around incident reporting timelines and TLPT.

Do microenterprises need to address all pillars?

Yes, but with proportionate implementation. Microenterprises benefit from simplified requirements, particularly for Pillar 1 (ICT risk management) and Pillar 3 (testing).

How Bastion Helps

Bastion provides end-to-end support across all five DORA pillars:

• Pillar 1: ICT risk management framework development and documentation
• Pillar 2: Incident response planning and reporting procedure design
• Pillar 3: Penetration testing coordination and TLPT preparation
• Pillar 4: Third-party risk assessment and Register of Information preparation
• Pillar 5: Guidance on information-sharing participation

Ready to address DORA's five pillars? Talk to our team

Sources

• DORA Chapters II-V - Official text covering the five pillars
• ESA Joint Technical Standards - Technical implementation standards
• EIOPA DORA Overview - Supervisory guidance on pillar implementation