One year after DORA: first lessons learned

Initial lessons learned  

The Digital Operational Resilience Act (DORA) has entered its operational phase. One year after coming into force, European financial institutions have embedded DORA in day‑to‑day governance, ICT risk management, incident handling, and third‑party oversight. 

Covering more than 22,000 financial entities across the EU, the regulation is fundamentally reshaping how organisations structure operational resilience. While DORA applies uniformly, its real‑world impact varies widely depending on the size, complexity, and maturity of institutions, as well as their reliance on external ICT providers. 

This white paper provides a practical, experience‑driven view of how banks and insurers are responding to DORA in practice. Built on Sopra Steria’s field experience across Europe, it focuses on operational challenges, observed practices, and the transition from initial compliance toward sustainable, long‑term operational resilience. 

Gain access to our insights on how financial institutions are adapting governance models, strengthening resilience, managing cyber risk, and addressing third‑party dependencies in the post‑DORA landscape. 

What will you find in this whitepaper?  

  • How Tier 1, Tier 2 and Tier 3 banks, neo‑banks, and insurers experience DORA differently across Europe 
  • Practical approaches to structuring DORA compliance frameworks beyond regulatory theory 
  • Lessons learned in ICT governance and crisis management under reinforced executive accountability 
  • How organisations are industrialising incident management and regulatory reporting 
  • Key insights into digital operational resilience testing, including Threat‑Led Penetration Testing (TLPT) 
  • How technology and automation are transforming third‑party risk management and supplier oversight