DORA Digital Operational Resilience Act — Concrete Obligations for Italian Banks and Insurers

Has your financial institution received a notice from the supervisory authority? Or are you still trying to figure out if DORA applies to you? Let's start with a fact: since the regulation came into force, digital operational resilience is no longer optional for financial entities in Europe. We, at Meteora Web, have been serving Italian companies since 2017. We have seen financial clients with outdated Linux servers, non-existent backups, and plain-text credentials. DORA is not a bureaucratic burden: it's an opportunity to get organized and protect your business from increasingly sophisticated attacks.

What changes for financial SMEs with DORA compared to the past?

From best practice to legal obligation

Before DORA, ICT risk management was often left to each company's good will. Now it is a precise regulatory requirement. Banks, insurance companies, investment firms, and payment institutions must demonstrate that they have solid processes to identify, prevent, and respond to digital incidents. Having antivirus and hoping for the best is no longer enough. You need a documented, tested, and updated framework.

Who is in and who is out

DORA applies to all financial entities defined in the regulation, including small and medium-sized enterprises in the sector. Critical ICT third-party providers (cloud providers, software companies) also fall within the scope, with reporting and audit obligations. If your company provides digital services to a bank, get ready to receive stringent contractual requests.

Immediate action: Check if your entity is listed in Annex III of the DORA regulation. If yes, you already have a compliance obligation. If not, keep an eye on supply chains: you might be involved as a critical provider.

How to manage ICT risk according to DORA?

Risk management framework

DORA requires an ICT risk management system based on three pillars: identification, protection, and detection. You don't need to reinvent the wheel: you can align with standards like ISO 27001 or NIST, but you must document everything and demonstrate effectiveness. We come from an accounting background: we know how important it is to track every operation. With DORA, ICT traceability becomes mandatory.

Incident reporting: what, when, to whom

You must notify significant incidents to your supervisory authority. Deadlines are tight: initial classification within hours, full report within days. Each incident must be recorded in a standard format. Here is an example of a JSON structure for the initial report:

{
  "incident_id": "DORA-001",
  "timestamp": "2026-01-15T14:30:00Z",
  "type": "availability_loss",
  "description": "Online banking service outage for 45 minutes.",
  "impact": "1000 users affected, no data loss.",
  "root_cause": "Firewall configuration error."
}

Immediate action: Prepare an incident report template and define an internal notification procedure. Train staff to recognize a significant event.

What testing and audit obligations apply to small entities?

TLPT and simplified tests

Large entities must perform Threat-Led Penetration Testing (TLPT) every three years. For SMEs, the regulation provides lighter but still mandatory tests: vulnerability assessment, penetration testing on web applications, incident simulations. You don't need an in-house red team: you can rely on specialized providers, but you must document the plan and results.

The ICT responsible person

DORA does not mandate a specific role, but it requires someone in the company to be responsible for ICT risk management. In a small business, that could be the owner, as long as they have adequate skills. We have seen too many SMEs with "the guy who tinkers" without a formal backup. With DORA, you need a clear appointment and a dedicated budget.

Immediate action: Draw up an annual test plan for 2026. Include at least quarterly vulnerability scans and an annual penetration test.

How to adapt contracts with ICT providers?

Mandatory clauses

DORA requires that contracts with critical ICT providers include specific clauses: audit rights, incident notification obligations, minimum service levels, termination rights in case of violations. If you work with cloud providers like AWS or Azure, check their terms: many are already adapting.

Register of critical third parties

You must maintain an up-to-date register of all ICT providers that handle sensitive data or support critical processes. For each provider, assess the risk and document mitigation measures. We have managed the ERP system of a clothing store from the inside: we know how easy it is to lose track of software dependencies. DORA forces you not to neglect this aspect.

Immediate action: Review contracts with your cloud, software management, and hosting providers. Add an audit clause and an incident notification obligation within 24 hours.

What to do now — Operational checklist for DORA compliance

Don't panic. DORA is a journey, not a destination. Here are 5 concrete actions to start today:

1. Map your ICT perimeter — List all systems, applications, and providers that touch financial data or critical processes.
2. Appoint a responsible person — Even if it's you, formalize the delegation of ICT risk management with an internal email.
3. Run a vulnerability assessment — Use tools like OpenVAS or an external provider to get a security baseline.
4. Prepare the incident report template — Use the JSON above as a base, customize it for your company.
5. Review insurance policies — Cybersecurity insurance is almost mandatory to cover incident costs.

For a complete overview of how DORA fits into the European regulatory landscape, read our pillar guide on NIS2 and EU cybersecurity regulation.

Official external resource: DORA Regulation text (EUR-Lex).