What is DORA and who does it apply to?

DORA stands for the Digital Operational Resilience Act. It is an EU regulation that came into force in January 2025 and applies to banks, insurance companies, investment firms, payment providers and other financial institutions operating in Europe.

The core idea is simple: financial services depend on technology. When that technology fails, whether due to a cyberattack, a software bug, or an infrastructure outage, real people and real businesses are affected. DORA requires financial institutions to prove they have taken that seriously.

It is not a recommendation. It is a legal requirement with real consequences for organisations that cannot demonstrate compliance.

Who does DORA apply to? Banks, insurers, investment firms, payment service providers, crypto-asset service providers and their critical technology suppliers operating in the EU. If your organisation touches financial services in Europe, DORA most likely applies to you.

What are the 5 DORA requirements for financial institutions?

DORA has five main pillars. Each one translates into specific technical and operational requirements for your IT team.

01	ICT risk management You must have a documented framework for identifying, assessing and managing technology risks. That means knowing what systems you have, what they depend on and what happens if they fail.
02	Incident reporting Significant technology incidents must be reported to regulators within 24 hours of detection. That requires the ability to detect incidents quickly and understand their business impact immediately.
03	Digital operational resilience testing You must regularly test whether your systems can withstand disruptions. Not just in theory but in practice, with documented results and evidence of remediation.
04	Third-party risk management You are responsible for the resilience of your technology suppliers too. If a cloud provider or software vendor fails, that is your problem under DORA, not theirs.
05	Information sharing Financial institutions are encouraged to share intelligence about cyber threats with each other and with regulators. Participation in threat intelligence sharing frameworks is part of the DORA picture.

We will guide you through DORA compliance — from assessment to regulator-ready. We implement the full DORA compliance stack for financial services IT teams: CMDB health check, Discovery, Service Mapping, Event Management and GRC. We know what regulators ask for, we build what you need, and we guide you through the process from first assessment to audit-ready evidence. Start your DORA compliance journey →

Why are most financial institutions not DORA compliant yet?

The challenge is not that organisations do not take DORA seriously. Most do. The challenge is that DORA compliance requires a level of visibility into your own IT infrastructure that most organisations simply do not have.

To report an incident within 24 hours, you need to detect it first and understand which business services it affects. To manage ICT risk, you need an accurate map of every system, every dependency and every potential point of failure. To demonstrate resilience, you need evidence, not just intentions.

That kind of visibility does not exist by default. It has to be built. And that is exactly what ServiceNow ITOM and GRC are designed to do.

In our experience, many organisations have a CMDB that is only partially accurate. Under DORA, that is not good enough. An incident affecting a system that is not in your CMDB is still your regulatory responsibility.

How does ServiceNow ITOM help with DORA compliance?

DORA compliance is not just a visibility problem — it is also a governance and documentation problem. ServiceNow addresses both through two complementary capability sets: ITOM gives IT teams a live, accurate picture of their infrastructure, while GRC (Governance, Risk and Compliance) creates the documented risk framework that regulators actually ask for.

CMDB A complete, accurate record of every system in your environment. DORA requires you to know what you have. CMDB is the foundation everything else builds on.	Discovery Automatically scans your network and populates the CMDB with what is actually running. No manual data entry, no outdated records.
Service Mapping Shows which infrastructure components support which business services. Critical for the 24-hour incident reporting requirement under DORA.	Event Management and AIOps Correlates alerts from monitoring tools and surfaces what actually matters. Reduces alert noise so your team responds to real incidents faster.
GRC — Governance, Risk and Compliance Maps your ICT risks against DORA requirements, tracks control status and generates audit-ready evidence automatically. Covers DORA pillars 1 and 5 directly — ICT risk management and third-party risk.	Integrated Risk Management (IRM) Extends GRC with risk heatmaps, continuous monitoring and vendor risk assessments. Turns DORA's third-party risk requirement from a manual exercise into an automated programme.

ITOM = infrastructure visibility  ·  GRC = governance and compliance documentation. Both are needed. We implement both.

How to become DORA compliant: 5 steps for IT operations teams

Getting from where most organisations are today to where DORA requires them to be is a process. Here is how we typically approach it with financial services clients.

Step 1	Start with a CMDB health check Before anything else, understand the current state. How accurate is your CMDB? What is missing? A two-week assessment gives you a clear picture of the gap between where you are and where DORA requires you to be.
Step 2	Implement Discovery Configure ServiceNow Discovery to scan your environment automatically. This stops the CMDB from degrading over time as systems change. What is in the record matches what is actually running.
Step 3	Map your critical services Use Service Mapping to connect infrastructure to business services. Prioritise payments, customer data and core banking functions. These are the ones regulators will ask about first.
Step 4	Configure event management Set up alert correlation and AIOps so incidents are detected and prioritised automatically. The 24-hour reporting clock starts at detection, not at the moment someone notices something is wrong.
Step 5	Implement GRC — document, evidence and demonstrate DORA compliance is not just about having the right tools. It is about being able to demonstrate you have them. ServiceNow GRC maps your ICT risks directly against DORA requirements, tracks control status and generates the audit evidence regulators ask for — automatically, not in a last-minute spreadsheet exercise. This covers what ITOM alone cannot: the documented risk management framework (pillar 1), third-party risk management (pillar 4) and the evidence trail that connects everything together.

How long does DORA compliance implementation take?

DORA is already in force. If your organisation has not started, the time pressure is real.

A focused CMDB and Discovery implementation for a mid-size financial institution typically takes 8 to 14 weeks. Service Mapping for critical services adds another 4 to 6 weeks on top of that. A full ITOM and GRC implementation that covers all DORA pillars from a standing start is typically a 6 to 9 month project.

That does not mean organisations that have not started are in trouble. Regulators generally expect organisations to demonstrate a clear remediation plan and measurable progress. But it does mean that starting now matters more than starting perfectly.

Key takeaways •  DORA applies to all financial institutions operating in the EU and has been in force since January 2025. •  It requires demonstrable visibility into your IT infrastructure, not just policies and intentions. •  ServiceNow ITOM covers the infrastructure requirements: CMDB accuracy, incident detection, service impact mapping and alert management. ServiceNow GRC covers the governance requirements: ICT risk framework, third-party risk and audit evidence. •  Most organisations need to start with a CMDB health check to understand their current gap before committing to a full implementation plan. •  A phased approach starting with Discovery and critical service mapping delivers early compliance value while the full implementation continues.

Ready to become DORA compliant? We guide financial services IT teams through the full DORA compliance process. We start with a platform health check to understand your current gap, implement the technical foundation your regulators require, and make sure your evidence is audit-ready. No commitment required for the first assessment. Start your DORA compliance journey →

HappyMan Solutions 
Your system works. Your team is happy. That's the job.