What is the primary objective of DORA?

The primary objective of DORA is to strengthen the digital operational resilience of the EU financial sector against ICT disruptions, including cyberattacks, system failures, and third-party risks. Regulation (EU) 2022/2554 mandates ICT risk management, incident reporting, resilience testing, and third-party oversight for 20 financial entity types and critical ICT third-party providers (CTPPs), applying fully since January 17, 2025.

Who is legally or professionally required to comply with DORA?

DORA applies to 20 types of EU financial entities, including credit institutions, insurance undertakings, investment firms, payment institutions, and crypto-asset service providers, plus critical ICT third-party providers (CTPPs). Approximately 22,000 regulated entities must comply, with CTPPs like cloud providers subject to ESA oversight; proportionality tailors requirements to size, complexity, and risk.

Does DORA require an external audit or third-party certification?

DORA does not mandate external audits or third-party certification but requires risk-based digital operational resilience testing, including independent annual basic tests and triennial threat-led penetration testing (TLPT) for critical entities. Testing may involve external providers, with results reported to authorities; third-party oversight includes contractual audit rights for CTPPs.

How often should an assessment for DORA be performed?

DORA requires annual basic ICT resilience tests, such as vulnerability assessments, and triennial advanced TLPT for designated critical entities. ICT risk management frameworks must undergo annual reviews, with incident response exercises and third-party risk assessments conducted ongoing or as risks evolve, per proportionality principles.

What are the consequences of non-compliance with DORA?

Non-compliance with DORA incurs administrative fines up to 2% of total global annual turnover for firms or €5 million (or 10% of annual salary) for individuals. Competent authorities and ESAs enforce penalties, alongside reputational damage, operational restrictions, and mandatory remediation for failures in ICT risk management, reporting, testing, or third-party oversight.

An DORA be mapped to other international frameworks?

Yes, DORA's ICT risk management, incident reporting, testing, and third-party oversight elements align structurally with mature resilience frameworks, facilitating gap analyses and integrated compliance programs. Financial entities often map DORA's proportional controls, 4-hour reporting timelines, and TLPT requirements to existing governance models for efficiency.

What is the first step to begin implementing DORA?

The first step for DORA implementation is conducting a gap analysis of current ICT risk management against the ESAs' Regulatory Technical Standards (RTS) on ICT frameworks, published January 17, 2024. This identifies deficiencies in strategies, incident classification, testing plans, and third-party policies, enabling prioritized remediation to meet the January 17, 2025 deadline.

What is the primary objective of AS9100?

The primary objective of AS9100 is to establish a quality management system (QMS) for aviation, space, and defense organizations that ensures product safety, configuration integrity, and supply chain reliability. AS9100D (2016) builds on ISO 9001:2015's 10-clause structure, adding over 100 aerospace-specific requirements in Clause 8, including operational risk management (8.1.1), configuration management (8.1.2), product safety (8.1.3), and counterfeit parts prevention (8.1.4), to prevent quality escapes with catastrophic potential.

Who is legally or professionally required to comply with AS9100?

AS9100 applies to organizations that design, develop, manufacture, or service aviation, space, and defense products and services. It targets manufacturers of parts, materials suppliers, design centers, and quality organizations in these sectors; major OEMs and primes require certification as a supplier qualification condition, with visibility via IAQG's OASIS database. AS9100D scope (Clause 4.3) demands precise definition, with limited non-applicability justified by product type or regulations.

Does AS9100 require an external audit or third-party certification?

Yes, AS9100 requires third-party certification through accredited bodies via a two-stage audit process. Stage 1 assesses documentation and readiness; Stage 2 verifies implementation and effectiveness per AS9101 guidance. Certification is maintained with annual surveillance audits and recertification every three years, emphasizing objective evidence of process control, nonconformity correction (typically 60-90 days), and continual improvement.

How often should an assessment for AS9100 be performed?

AS9100 requires internal audits at planned intervals per a risk-based program (Clause 9.2), with external surveillance annually and full recertification every three years. Organizations conduct internal audits covering all processes, focusing on high-risk areas like Clause 8 controls; management reviews (Clause 9.3) occur periodically to evaluate performance, risks, and improvements.

What are the consequences of non-compliance with AS9100?

Non-compliance with AS9100 risks certification suspension, loss of supplier approval, and exclusion from OEM contracts via OASIS delisting. Audits identify nonconformities requiring root-cause analysis (considering human factors) and corrective actions; persistent issues lead to major nonconformities, failed recertification, supply chain disqualification, and potential safety incidents with regulatory or liability exposure.

An AS9100 be mapped to other international frameworks?

Yes, AS9100D aligns with Annex SL's 10-clause structure, enabling mapping to compatible management systems. Its ISO 9001:2015 base supports integration for shared processes like risk-based thinking (Clause 6.1), performance evaluation (Clause 9), and improvement (Clause 10), while aerospace additions like product safety enhance interoperability without clause conflicts.

What is the first step to begin implementing AS9100?

The first step to implement AS9100 is conducting a gap analysis against AS9100D requirements. Review current processes versus Clauses 4-10, identify gaps in aerospace controls (e.g., configuration management), define QMS scope (Clause 4.3), and prioritize high-risk areas like Clause 8 via cross-functional teams, producing a remediation plan with timelines and resources.

Standards Comparison

DORA vs AS9100

DORA

Mandatory

2023

EU regulation for digital operational resilience in financial sector

AS9100

Mandatory

2016

International standard for aerospace quality management systems.

Quick Verdict

DORA mandates ICT resilience for EU financial entities against cyber threats via risk frameworks and testing, while AS9100 certifies quality systems for aerospace firms emphasizing safety, configuration, and counterfeit controls. Firms adopt DORA for compliance, AS9100 for market access.

Digital Operational Resilience

DORA

Digital Operational Resilience Act (Regulation (EU) 2022/2554)

Cost

€€€€

Complexity

High

Implementation Time

18-24 months

Key Features

Mandates comprehensive ICT risk management frameworks
Standardizes 4-hour initial incident reporting timelines
Requires triennial TLPT for critical financial entities
Oversees critical third-party providers with ESAs supervision
Harmonizes resilience standards across EU financial sector

Quality Management

AS9100

AS9100D Quality Management Systems for Aviation, Space, Defense

Cost

€€€€

Complexity

High

Implementation Time

12-18 months

Key Features

Configuration management for product integrity
Product safety planning across lifecycle
Counterfeit parts prevention controls
Operational risk management in processes
Enhanced supplier evaluation and monitoring

Detailed Analysis

A comprehensive look at the specific requirements, scope, and impact of each standard.

DORA Details

What It Is

Digital Operational Resilience Act (DORA), formally Regulation (EU) 2022/2554, is a transformative EU regulation enhancing digital operational resilience in the financial sector against ICT risks like cyberattacks and failures. It targets 20 financial entity types (e.g., banks, insurers) and critical ICT third-party providers (CTPPs) across 27 member states, using a proactive, risk-based, proportional approach.

Key Components

**ICT Risk ManagementComprehensive frameworks for risk identification, mitigation, and annual reviews.
**Incident Reporting4-hour initial, 72-hour intermediate notifications for major incidents.
**Resilience TestingAnnual basic tests; triennial threat-led penetration testing (TLPT).
**Third-Party OversightDue diligence, monitoring, ESAs-led supervision of CTPPs. Compliance enforced via RTS/ITS, with fines up to 2% turnover.

Why Organizations Use It

Legal mandate enforced since the January 17, 2025 deadline.
Mitigates systemic cyber risks (74% ransomware hit rate).
Builds stakeholder trust, reduces outage impacts like CrowdStrike.
Harmonizes rules, drives cybersecurity investments (€10-15B EU-wide).

Implementation Overview

Conduct gap analyses, deploy tools for reporting/testing, revise vendor contracts. Applies to ~22,000 EU entities proportionally by size/complexity. Involves training, simulations; ongoing audits, no formal certification but ESAs enforcement.

AS9100 Details

What It Is

AS9100D (AS9100:2016) is the international quality management system (QMS) standard for aviation, space, and defense organizations. It extends ISO 9001:2015 with over 100 aerospace-specific requirements, using a process-based, risk-oriented approach to ensure product safety and supply chain integrity.

Key Components

10-clause Annex SL structure covering context, leadership, planning, support, operation, evaluation, and improvement.
Aerospace additions: configuration management (8.1.2), product safety (8.1.3), counterfeit prevention (8.1.4), operational risk (8.1.1).
Built on risk-based thinking, human factors, and supplier controls.
Certification via accredited third-party audits (Stage 1/2, surveillance).

Why Organizations Use It

Meets OEM/contractual mandates for market access.
Reduces defects, improves delivery, lowers costs.
Enhances safety, traceability, and stakeholder trust.
Drives competitive edge via OASIS visibility.

Implementation Overview

Phased: gap analysis, process design, training, audits (6-18 months).
Applies to manufacturers, suppliers, MROs globally.
Requires documented processes, internal audits, management reviews.

Key Differences

Aspect	DORA	AS9100
Scope	ICT risk management, incident reporting, resilience testing, third-party oversight	Quality management with aerospace additions: configuration, safety, counterfeit prevention
Industry	EU financial sector (20 entity types)	Global aviation, space, defense manufacturing
Nature	Mandatory EU regulation	Voluntary certification standard
Testing	Annual basic, triennial TLPT by authorities	Stage 1/2 audits, annual surveillance, 3-year recertification
Penalties	Up to 2% global turnover fines	Loss of certification, no legal fines

Scope

DORA

ICT risk management, incident reporting, resilience testing, third-party oversight

AS9100

Quality management with aerospace additions: configuration, safety, counterfeit prevention

Industry

DORA

EU financial sector (20 entity types)

AS9100

Global aviation, space, defense manufacturing

Nature

DORA

Mandatory EU regulation

AS9100

Voluntary certification standard

Testing

DORA

Annual basic, triennial TLPT by authorities

AS9100

Stage 1/2 audits, annual surveillance, 3-year recertification

Penalties

DORA

Up to 2% global turnover fines

AS9100

Loss of certification, no legal fines

Frequently Asked Questions

Common questions about DORA and AS9100

DORA FAQ

AS9100 FAQ

You Might also be Interested in These Articles...

SOC 2 Audit Survival Guide: Auditor Questions, Red Flags, and Evidence Prep for First-Time Pass

Ace your SOC 2 audit with predicted auditor questions, model answers, red flags, and evidence checklists from CPA best practices & SignWell's journey. Reduce st

NIST CSF 2.0: Key Enhancements and How They Address Evolving Cyber Threats

Explore NIST CSF 2.0 updates: Govern function, supply chain security, SME playbooks for ransomware & AI threats. Boost your cyber defenses now!

Top 10 Reasons CMMC Level 3 Certification Unlocks Competitive Edge for Primes Handling Critical DoD Programs

Discover top 10 reasons CMMC Level 3 certification unlocks competitive edge for DoD primes. Reduced APT risks, procurement prefs, NIST 800-172 compliance via v2

Run Maturity Assessments with GRADUM

Transform your compliance journey with our AI-powered assessment platform

Assess your organization's maturity across multiple standards and regulations including ISO 27001, DORA, NIS2, NIST, GDPR, and hundreds more. Get actionable insights and track your progress with collaborative, AI-powered evaluations.

100+ Standards & Regulations

AI-Powered Insights

Collaborative Assessments

Actionable Recommendations

Explore More Comparisons

See how DORA and AS9100 compare against other standards

Other DORA Comparisons

Other AS9100 Comparisons

What It Is

Key Components

**ICT Risk ManagementComprehensive frameworks for risk identification, mitigation, and annual reviews.

**Incident Reporting4-hour initial, 72-hour intermediate notifications for major incidents.

**Resilience TestingAnnual basic tests; triennial threat-led penetration testing (TLPT).

**Third-Party OversightDue diligence, monitoring, ESAs-led supervision of CTPPs. Compliance enforced via RTS/ITS, with fines up to 2% turnover.

What It Is

Key Components

10-clause Annex SL structure covering context, leadership, planning, support, operation, evaluation, and improvement.

Aerospace additions: configuration management (8.1.2), product safety (8.1.3), counterfeit prevention (8.1.4), operational risk (8.1.1).

Built on risk-based thinking, human factors, and supplier controls.

Certification via accredited third-party audits (Stage 1/2, surveillance).

Aspect

DORA

AS9100

Scope

ICT risk management, incident reporting, resilience testing, third-party oversight

Quality management with aerospace additions: configuration, safety, counterfeit prevention

Industry

EU financial sector (20 entity types)

Global aviation, space, defense manufacturing

Nature

Mandatory EU regulation

Voluntary certification standard

Testing

Annual basic, triennial TLPT by authorities

Stage 1/2 audits, annual surveillance, 3-year recertification

Penalties

Up to 2% global turnover fines

Loss of certification, no legal fines