Are we a DORA financial entity or an ICT supplier? Where does this risk belong on the risk map?
| Status | Test | Main risks |
|---|---|---|
| EU financial entity (including subsidiaries established in the EU) | Listed in Article 2(1) | ICT risk management, major incident reporting, resilience testing, third-party risk |
| ICT third-party service provider to financial entities | Provides ICT services to those entities | Article 30 contract clauses, register information, exit arrangements |
| Designated critical ICT third-party service provider | Designated by the European Supervisory Authorities under Article 31 | Direct oversight by a lead overseer |
DORA has applied since 17 January 2025. Under the categories in Article 18 of the TWSE and TPEx Risk Management Best Practice Principles for Listed Companies, it sits in information risk and compliance risk; third-party concentration and exit also affect operational risk. The principles are for listed companies to refer to; companies that are not public companies are not covered and can use them voluntarily.
What does DORA require of the board (management body)? What should the CRO's report cover?
Under Article 5(2), the management body of a financial entity must:
- bear the ultimate responsibility for managing ICT risk;
- approve the digital operational resilience strategy, including the ICT risk tolerance level;
- approve, oversee and periodically review the ICT business continuity policy and ICT response and recovery plans;
- approve and periodically review ICT internal audit plans, and allocate the budget resilience needs;
- approve the policy on using ICT third-party services and set up reporting channels on arrangements with ICT third parties, material changes and the impact of major ICT incidents.
Article 5(4) requires members of the management body to train regularly and keep sufficient knowledge to understand and assess ICT risk. The CRO's report can follow these items directly: tolerance versus actual position, third-party dependence, incidents and test results.
How should a CRO assess ICT third-party concentration risk and exit strategies?
DORA requires third-party risk to be explicitly included in the ICT risk management framework and concentration risk to be considered (Articles 28 and 29); every contract for ICT services must be recorded in the register of information, noting whether it supports critical or important functions; outsourcing that supports critical or important functions must always have an exit strategy available.
One way to assess it:
- Concentration: which critical or important functions depend on the same provider, cloud or location
- Substitutability: how long a switch would take and whether service can continue in the transition
- Contracts: whether the Article 30 clauses are complete (service description, data processing locations, incident assistance, termination rights; for critical or important functions also service levels, business continuity testing, audit rights and exit strategy)
- Register: whether the information is complete and matches the actual contracts
The first 19 critical ICT third-party service providers, published on 18 November 2025, include no Taiwanese company.
Can the criteria for major ICT-related incidents be used directly as KRI thresholds?
They can serve as the skeleton for KRI tiers. Under Delegated Regulation (EU) 2024/1772 the classification criteria are: clients, financial counterparts or transactions affected; reputational impact; duration and service downtime; geographical spread; impact on the availability, authenticity, integrity or confidentiality of data; and economic impact. An incident is major when it affects critical services and either involves successful, malicious and unauthorised access or reaches two or more materiality thresholds.
Reporting deadlines for a major incident: initial notification within 4 hours of classification as major and no later than 24 hours after detection; an intermediate report within 72 hours of the initial notification; a final report within one month of the latest intermediate report.
A practical approach: use the same criteria to set early-warning values that trigger before the legal thresholds, so KRIs, incident classification and reporting share one language. The threshold values are those in the text of 2024/1772.
How should DORA penalty exposure be estimated? Is it 2% of worldwide turnover?
No. DORA sets no turnover-based fine for financial entities; penalties are laid down by Member States in national law under Article 50 and must be effective, proportionate and dissuasive. "2% of worldwide annual turnover" is the NIS2 Article 34 rule for essential entities, which under NIS2 Article 4 does not apply to DORA financial entities.
Only a designated critical ICT third-party service provider can face periodic penalty payments from the lead overseer under Article 35: imposed daily, for up to six months, of up to 1% of the average daily worldwide turnover in the preceding business year.
For a Taiwanese ICT supplier, the impact assessment centres on contracts: client termination, audit findings and liability clauses. Contractual liability should be assessed case by case by legal counsel.
How do DORA business continuity and resilience testing connect with ISO 22301?
DORA Articles 11 and 12 require an ICT business continuity policy, backup and recovery, and testing; what is needed is measures that exist and are tested, not a certificate. The ISO 22301 business impact analysis, strategy and exercises are exactly the evidence of those measures:
| ISO 22301 | DORA |
|---|---|
| Business impact analysis (clause 8.2) | Article 11 impact analysis |
| Exercises (clause 8.5) | Article 11(6) testing |
| Backup and recovery (27001 A.8.13) | Article 12 |
Also plan an annual resilience test programme and assess whether threat-led penetration testing (TLPT) applies. The ISO 22301 timeline (as listed on the service page) is usually 4–7 months, or about 3–5 months with ISO 27001 in place.
How does Winners Consulting help a CRO with DORA?
- Status: confirm whether you are a financial entity or an ICT supplier, and assess the scope of direct and contractual obligations and register readiness
- ICT risk management framework: under Chapter II, asset inventory, risk assessment, protection, detection, response and recovery procedures
- Incidents and third parties: major incident classification criteria and reporting SOP; supplier risk assessment method, mandatory contract clauses and register maintenance
- Resilience testing: annual test plan and TLPT applicability assessment; a combined DORA + NIS2 assessment
- Timeline (as listed on the service page): preparing an ICT supplier's contractual obligations usually 2–3 months; a full framework for a financial institution usually 6–9 months, shorter with an ISO 27001/BCM base
- Who leads: VP- and director-level consultants lead the work end to end, never outsourced; the first assessment is free
More: DORA consulting, Choosing a DORA consultant, ISO 22301, CRO role page
How other roles see this service
Other services for this role
- ERM for CROs: how do you build the risk map, KRIs and board reporting?
- ISO 22301 for CROs: how do scenarios, RTOs and exercises enter the risk report?
- ISO 37001 for CROs: how do you manage bribery scenarios and overseas exposure?
- Trade secrets for CROs: how do you set leak scenarios, reasonable measures and KRIs?
- ISO 27001 for CROs: how do information and enterprise risk share one scale?
- AI risk for CROs: what to decide first on ISO 42001 and the EU AI Act?
- GDPR for CROs: how to assess fines, intra-group transfers and breach scenarios?
- NIS2 for CROs: how to assess scope, fines and management body duties?
- EU CRA for CROs: how to handle market access risk, reporting and oversight?
- CRO and AI transformation: putting AI risk into the risk map, KRIs and board reports
Official sources
- Regulation (EU) 2022/2554 DORA（EUR-Lex）
- BaFin：DORA — Digital Operational Resilience Act（2022-09-22）
- AFM：DORA — Third-party providers
- FMA Austria：DORA — ICT-related incidents
- Commission Delegated Regulation (EU) 2024/1772: classification of major ICT-related incidents (EUR-Lex)
- ESAs: designation of critical ICT third-party providers (18 November 2025)
- 上市上櫃公司風險管理實務守則（證交所法規分享知識庫，111.08.08）