With the DORA Regulation (EU 2022/2554), digital resilience is now on the board’s agenda: ICT strategy, supplier selection, and the ability to prevent disruptions become the direct responsibility of top management.
Key points:
- Ultimate responsibility for ICT risk lies with the board and cannot be delegated.
- Board members must maintain up-to-date knowledge of technology risk.
- ICT risk management cannot be entrusted to internal audit.
- Every ICT provider falls within the financial institution’s risk scope.
- Proprietary infrastructure and data located in Italy reduce dependencies and reliance on subcontractors.
An ICT incident, a service interruption, a vulnerability, or a software malfunction—until yesterday, these were issues to be handled at the operational level. Today, these are questions that the supervisory authority can bring directly to the attention of a financial institution’s management: who assessed the risk, what measures were put in place, and when the board was informed. This is the most tangible effect of the DORA regulation. Digital operational resilience is no longer just a line item in the IT budget. It has become a governance decision, with personal accountability resting with top management. For banks, insurance companies, and intermediaries, the question is no longer whether to comply. It’s about turning an obligation into a competitive advantage: more robust processes, carefully selected suppliers, and a technology stack that the board understands and controls.
From an IT Issue to a Top-Management Responsibility: What Changes with DORA
The DORA regulation shifts digital resilience from the IT department to the top management level: the board defines the strategy, approves the acceptable level of risk, and is accountable for technology choices and vendors.
DORA (Digital Operational Resilience Act): Regulation (EU) 2022/2554, in effect as of January 16, 2023, and applicable as of January 17, 2025. It establishes a single framework for ICT risk management in the financial sector, ensuring that every entity is able to withstand, adapt to, and recover from technology-related operational disruptions.
The scope is broader than is often assumed: the regulation applies to a very wide range of financial market participants. In addition to banks and insurance companies, it includes, among others, payment institutions and electronic money institutions, investment firms, asset management companies and alternative fund managers, pension funds, trading venues and central counterparties, credit rating agencies, and providers of services for crypto-assets. Through contracts and oversight of critical suppliers, it also involves ICT providers and cloud providers that support the entire financial supply chain.
However, not all entities are treated the same way. Article 2, paragraph 3, excludes certain small entities, such as small alternative fund managers, pension funds with no more than 15 members, and small and medium-sized insurance intermediaries. Article 16 also provides for a simplified ICT risk management framework for smaller and less interconnected entities.
Behind such a broad scope lies a clear plan: the European legislature has set three objectives for the regulation.
- Harmonize: Bring together into a single body of European rules that were previously fragmented regarding the resilience of the financial sector.
- Fill the gaps: provide a common framework for entities that lacked specific regulations on digital risk.
- Govern outsourcing: Mitigate third-party risk associated with ICT services outsourced to third parties.
According to IDC (July 2025), public cloud spending in Europe will rise from $229 billion in 2025 to $452 billion in 2029, with an average annual growth rate of 19%. Banks, insurance companies, and capital markets are among the regulated sectors driving demand: more outsourced services mean more risk to manage at the top.
+19%
Crescita media annuaLa spesa europea in public cloud raggiungerà 452 miliardi di dollari entro il 2029Fonte: IDC11%
Degli incidenti cyber riguarda il settore finanziarioGli incidenti significativi notificati nel 2024 ai sensi della direttiva NISFonte: ENISA Threat Landscape 202520%
I workload migrano verso provider localiEntro il 2027, una quota dei carichi di lavoro passerà dai provider globali a quelli localiFonte: Gartner, febbraio 2026Why does the DORA regulation apply to top management and not just the IT department?
The DORA regulation places ultimate responsibility for ICT risk at the top level, while the CIO (Chief Information Officer) retains operational management of the measures. The board sets priorities, oversees risk, and verifies the effectiveness of the measures adopted. It is no coincidence that when top management remains on the sidelines, even the best cyber risk assessment tools struggle to translate into concrete decisions.
What DORA is asking the board
The governing body must define, approve, oversee, and be accountable for the ICT risk management framework. This is not merely a rubber-stamp role; it requires up-to-date expertise and a regularly reviewed resilience strategy.
Right from the outset, the regulation calls on top management to play an active and fundamental role in guiding the resilience strategy. It is not enough to simply oversee systems: the board must also address people and processes, fostering a culture of cyber hygiene at all levels of the organization, and continuously monitor ICT risk, not just during annual reviews. Article 5 translates this principle into specific obligations, and Article 3 clarifies that the scope also includes supervisory bodies: the supervisory board and non-executive directors. Legislative Decree 23/2025, which brings Italian law into compliance, extends this responsibility to corporate officers as well. Board members are not expected to become technical experts, but they must refrain from approving decisions they are unable to evaluate.
At the operational level, there are six areas in which top management is called upon to make decisions and provide answers:
- Risk appetite: definition of the entity’s ICT risk tolerance level.
- Resilience strategy: Approval and periodic review of the digital operational resilience strategy.
- Business continuity: Approval of the ICT continuity policy and response and recovery plans.
- Budget: Adequate resources for resilience, including training.
- Third-party risk: Approval of the policy on third-party ICT services and disclosure of relevant agreements.
- Skills: knowledge of technology risk actively maintained and updated through ongoing training.
Who oversees ICT risk alongside the board?
An ICT risk control function with an appropriate level of independence operates alongside the board. In its communication dated December 30, 2024, the Bank of Italy clarified that this function may be part of risk management or compliance. However, it cannot be assigned to the unit that manages internal audit, which must remain the third level of control and preserve its independence of judgment.
The risk falls outside the scope: ICT suppliers
The financial institution remains fully responsible even when it outsources ICT services to third parties. For this reason, the choice of provider is a critical decision: the board must be familiar with the provider’s infrastructure, supply chain, and exit terms.
Article 28 is based on a clear principle: outsourcing does not transfer liability. Every contract must include the minimum provisions set forth in Article 30: data localization, service levels, audit rights, incident support, and termination rights. For services supporting critical functions, tested business continuity plans and exit plans with a transition period must also be included. European regulators are working with the same data: on November 18, 2025, the EBA, EIOPA, and ESMA published the first list of critical ICT providers, assessed based on systemic importance, role in critical functions, and substitutability.
On July 16, 2025, the European Central Bank published the Guide on the Outsourcing of Cloud Services, which supervisory teams use as a benchmark for banks under direct supervision.
What must the DORA information registry contain?
The DORA information register lists all agreements with third-party ICT providers: service, supported function, data location, relevant subcontractors, and contractual terms. According to the Bank of Italy’s communication dated February 13, 2026, the report must be submitted annually by March 15, with data as of the previous December 31. For the board, it serves as a map of the company’s dependencies.
What characteristics must an ICT provider have for the financial sector?
An ICT provider suited to the financial sector directly manages the infrastructure on which it delivers its services and supports the client in compliance matters—not just in technology. During the selection process, certain criteria can help distinguish a partner from a mere supplier:
- Proprietary infrastructure: In-house-managed networks, data centers, and cloud services shorten the supply chain and simplify record-keeping, audits, and due diligence.
- Single point of accountability: A single point of contact responsible for connectivity, hosting, and cloud services reduces contractual gray areas.
- Guaranteed location: Data and workloads are housed in identified data centers under a known jurisdiction.
- Expertise and experience: Teams accustomed to working with regulated entities, with up-to-date security and business continuity certifications.
- Hands-on support: practical assistance with audits, resilience testing, and exit plans—not just with service delivery.
Data and Infrastructure Sovereignty: A Matter of Risk
Data sovereignty is not an explicit requirement of the DORA regulation, but it follows from it: guaranteed localization, control over the technology chain, and the ability to exit reduce the risk of concentration that the board must assess.
Article 29 requires an assessment of the risk of concentration before signing agreements that support essential functions. There are two scenarios: relying on a provider that is difficult to replace, or accumulating contracts with the same group. Data localization is part of this assessment, as it affects oversight, jurisdiction, and recovery times. Exit strategies must also be planned in advance to avoid lock-in: as of September 12, 2025, the Data Act requires cloud providers to allow switching within defined timeframes, and as of January 12, 2027, it prohibits exit fees, as described by the European Commission. Private and hybrid cloud architectures, colocation data centers in Italy, and dedicated connectivity to public clouds are the most commonly used strategies for balancing the portfolio.
According to Gartner (February 2026), European spending on sovereign cloud IaaS will rise from $6.9 billion in 2025 to $23.1 billion in 2027. After governments, the main buyers are regulated industries, and 20% of workloads will shift from global providers to local providers.
How is ICT concentration risk measured?
ICT concentration risk is measured by cross-referencing the information registry with the map of essential functions, using four indicators to be presented to the board:
- Functional dependency: how many essential functions rely on the same provider.
- Expenditure share: the percentage of the ICT budget allocated to the same group.
- Substitutability: Estimated time and cost to migrate to an alternative.
- Overlap: the same data centers operated by different providers.
This type of approach is already a reality in the financial sector. Retelit’s portfolio includes major players in asset management, lending, and financial services, which have chosen it as their provider of hybrid cloud infrastructure in its Tier IV-certified data centers, integrated with the leading public clouds. Critical data remains in Italy and under the direct control of client organizations, in line with the requirements of the DORA and the NIS2 Directive (EU 2022/2555). Retelit’s approach to this topic is explored in depth in the article on digital sovereignty and technology choices and on the page dedicated to solutions for banks, insurance companies, and fintech firms.
Prevent Before You React: Resilience Is Built Before an Incident Occurs
The resilience required by the DORA regulation must be built in advance: mapping assets and dependencies, data protection, tested business continuity, and periodic testing are more valuable than any improvised response.
Those who view DORA as an opportunity—rather than a mere compliance requirement—focus on three areas of action. The goal is to improve the efficiency, effectiveness, and safety of critical processes, not to produce documents for regulatory oversight.
- Assessment and governance: identify and document functions, ICT assets, and dependencies on suppliers; define roles, policies, and tools commensurate with the entity’s scale; continuously monitor systems and services.
- Adaptation: Protect data transfer and storage from data breaches, loss, and unauthorized access; integrate backup, business continuity, and disaster recovery plans into the risk management framework; train staff and prepare crisis communication plans for customers and stakeholders.
- Response and testing: Classify incidents by severity with clearly defined roles, and verify security posture through vulnerability assessments, penetration tests, and—for the most critical entities—threat-based testing at least every three years.
According tothe ENISA Threat Landscape 2025, the financial sector accounted for 11% of the significant incidents reported in 2024 under the NIS Directive, and the agency notes the growing exploitation of the digital supply chain. Prevention, therefore, must start with suppliers.
What services help prevent operational disruptions?
Outages are prevented through continuous security monitoring and recovery plans developed in advance. A Managed Detection and Response service intercepts threats before they become incidents, while a strategic approach to disaster recovery defines the timelines and priorities for restoring essential functions.
DORA and NIS2: Where They Overlap
NIS2 gives way to the DORA Regulation for financial entities, but remains relevant for ICT providers and groups engaged in non-financial activities.
NIS2, transposed into Italian law by Legislative Decree 138/2024, which took effect on October 16, 2024, shares the same framework as DORA: senior management accountability, risk management, incident reporting, and supply chain security. For the banking sector and financial market infrastructures, DORA takes precedence. However, many ICT providers in the financial sector are subject to NIS2, and diversified groups must manage both frameworks. This context is explored in greater detail in the article on the second implementation phase of NIS2.
| Criterion | DORA | NIS2 |
|---|---|---|
| Reference | Regulation (EU) 2022/2554, Legislative Decree 23/2025 | Directive (EU) 2022/2555, Legislative Decree No. 138/2024 |
| Entities | Supervised financial institutions | Critical and important entities in 18 sectors |
| Governance | Board Responsible for the ICT Risk Framework | Governing bodies responsible for the measures |
| Suppliers | Register, mandatory clauses, monitoring of critical suppliers | Supply Chain Security |
| Regulatory Authorities in Italy | Bank of Italy, Consob, IVASS, COVIP | ACN and sector-specific authorities |
Questions the Board Should Ask Itself About ICT Providers
The board should not get into technical details, but it should ask the CIO the right questions and insist on documented answers that are updated with each contract renewal.
Seven questions help the board verify that third-party risk is managed—not just tracked.
- Dependency: Which essential functions would be disrupted if the primary provider were unavailable?
- Infrastructure: Does the provider own its own network, data center, and cloud, or does it resell third-party services?
- Subcontracting: Do we know the entire subcontracting chain for critical services?
- Location: In which countries is our data stored and processed?
- Exit: Has the exit plan been tested, and how long would it take us to switch providers?
- Support: Does the provider assist us with audits, testing, and regulatory requests?
- Reporting: How often does the board receive an updated overview of third-party risks?
The CIO can turn these questions into an annual dashboard for the board, linked to the information registry and the renewal cycle.
Resilience as a Strategic Lever
The DORA regulation does not require financial institutions to spend more on technology. It requires them to make better decisions. For banks, insurance companies, asset management firms, and intermediaries, digital resilience is now a matter of governance: it is built at the top, measured against suppliers, and demonstrated before a disruption puts it to the test.
Those who limit themselves to formal compliance will have completed records and approved policies. Those who approach it as a strategic choice will have something even more valuable: a technology stack that is well-understood and controlled, suppliers who are partners rather than mere counterparties, and a board capable of answering any questions from regulators.
This is where DORA presents an opportunity. Organizations that invest today in reliable infrastructure, well-managed data, and top-tier expertise are not just mitigating regulatory risk. They are building the trust of customers, investors, and the market—the true capital of the financial sector.
Frequently Asked Questions About the DORA Regulation
Ultimate responsibility lies with the management body, including the supervisory board and non-executive directors. Senior management defines, approves, and oversees the ICT risk management framework. The IT, risk management, and compliance functions implement and monitor the measures, but they do not replace the board’s responsibility.
Yes, board members must actively keep their knowledge and skills up to date so they can understand and assess ICT risks. This entails an obligation for senior management to engage in ongoing training. A technical background is not required, but they must be able to read and critically evaluate the information they receive.
The information report must be submitted annually by March 15, with data as of December 31 of the previous year. The annual reporting frequency was established by the Bank of Italy in its notice dated February 13, 2026.
In collaboration with Andrea Priviero, Product Marketing, Retelit