DORA: Digital Operational Resilience

Question 1

Who does DORA apply to?

Accepted Answer

Regulation (EU) 2022/2554 (DORA) applies to financial entities under Article 2, including: banks, payment institutions and electronic money institutions, including small payment service providers and small electronic money issuers, crypto-asset service providers (CASPs), investment firms, alternative investment fund managers and management companies, insurers, reinsurers and larger insurance intermediaries, crowdfunding service providers. Conversely, DORA does not apply, for example, to sub-threshold fund managers under Article 3(2) of the AIFMD, in the Czech Republic typically persons under Section 15 of the Czech Investment Companies and Investment Funds Act (ZISIF), or to insurance intermediaries that are small or medium-sized enterprises (Article 2(3) DORA).

Question 2

What does DORA require?

Accepted Answer

ICT risk management (Articles 5 to 16): a digital operational resilience strategy, an asset inventory, security policies, business continuity, backup and recovery. Small payment service providers, small electronic money issuers and small investment firms can use the simplified framework under Article 16. Incident management and reporting (Articles 17 to 23): classification of incidents and reporting of major incidents to the CNB. Testing (Articles 24 to 27): a testing programme, with critical systems tested at least once a year. Threat-led penetration testing (TLPT) at least every three years is required only of entities designated by the CNB. Third-party risk management (Articles 28 to 30): a register of information on contracts with ICT providers, mandatory contract terms and exit strategies.

Question 3

What does the CNB check in practice?

Accepted Answer

The CNB started its first supervision under DORA in 2025. It included 16 entities from investment and payment services in a pilot review and used a questionnaire with more than 400 control questions. Managing relationships with ICT providers caused companies the most work: they had to amend contracts, add provider obligations and start keeping records they had not kept systematically before (Právní prostor, CNB annual report for 2025, in Czech).

Question 4

What is the register of information and when is it submitted?

Accepted Answer

The register of information records all contracts with ICT service providers, including cloud, software and IT outsourcing (Article 28(3) DORA). The CNB collects it through the SDAT system. In 2026, the deadline was 2 March 2026. The CNB informs reporting entities of the obligation and the deadline by a notice (CNB, DORA – reporting entities, in Czech).

Question 5

How quickly must a major incident be reported?

Accepted Answer

initial notification: within 4 hours of classifying the incident as major, and no later than 24 hours after becoming aware of it, intermediate report: within 72 hours of the initial notification, final report: within 1 month of the latest intermediate report. The deadlines are set by Commission Delegated Regulation (EU) 2025/301. The classification and reporting procedure must therefore be ready in advance, not only during an incident.

Question 6

How does DORA relate to the Czech Cybersecurity Act?

Accepted Answer

For financial entities, DORA is sector-specific legislation. Where it regulates cyber risk management and incident reporting equivalently, it takes precedence over Act No. 264/2025 Coll., on Cybersecurity, which implements the NIS2 Directive. The Cybersecurity Act still applies where DORA does not cover a given area, for example registration with the NÚKIB. Primary supervision is exercised by the CNB, with the NÚKIB in a complementary role (joint statement of the CNB and NÚKIB, 24 June 2026, in Czech).

Question 7

How can we help?

Accepted Answer

Tailored DORA documentation: strategy, policies, internal rules, ICT asset inventory and continuity plans, see the overview of DORA documentation. Contracts with ICT providers: review and amendment under Article 30 DORA. Register of information: compiling the register and submitting it to the CNB. Incidents: classification and reporting procedure, report templates for the CNB. Testing: a digital operational resilience testing programme. CNB inspection: preparation for the questionnaire and the review. We deliver the documentation as a package of services for implementing DORA. For new applicants for a CNB licence, we prepare it directly as part of the application.

Question 8

Does DORA also apply to small payment institutions?

Accepted Answer

Yes. DORA also applies to small payment service providers and small electronic money issuers. However, they can use the simplified ICT risk management framework under Article 16.

Question 9

Does DORA apply to persons under Section 15 ZISIF?

Accepted Answer

No. Sub-threshold fund managers under Article 3(2) of the AIFMD are excluded from the scope of DORA.

Question 10

Do we have to carry out TLPT penetration tests?

Accepted Answer

Only if the CNB designates you. Other entities test under their own testing programme, with critical systems at least once a year.

Question 11

Do we have to amend contracts with cloud and software providers?

Accepted Answer

In most cases, yes. Contracts must contain the terms required by Article 30 DORA, and stricter requirements apply to services supporting critical or important functions, such as audit rights and exit strategies.

Question 12

How much does DORA implementation cost?

Accepted Answer

The price depends on the size of the company, the scope of its activities and the documentation you already have. After an initial consultation, we will prepare a tailored written offer for you. Write to us at info@stuchlikova.com to arrange an initial consultation.