DORA
EU regulation for digital operational resilience in financial sector
EN 1090
EU harmonized standard for steel and aluminium structural execution.
Quick Verdict
DORA mandates ICT resilience for EU finance against cyber threats, while EN 1090 requires certified FPC for CE-marking steel/aluminium structures. Finance adopts DORA for regulatory compliance; manufacturers use EN 1090 for EU market access.
DORA
Regulation (EU) 2022/2554, Digital Operational Resilience Act
Key Features
- Mandates comprehensive ICT risk management frameworks overseen by management body
- Requires incident reporting within 4 hours for major disruptions
- Enforces risk-based resilience testing including triennial TLPT
- Imposes direct ESAs oversight on critical third-party providers
- Harmonizes rules across 20 EU financial entity types proportionally
EN 1090
EN 1090 Execution of steel and aluminium structures
Key Features
- Factory Production Control (FPC) certification
- Execution Classes (EXC1-EXC4) risk scaling
- CE marking under CPR for market access
- Welding quality via ISO 3834 alignment
- Material traceability and NDT inspection regimes
Detailed Analysis
A comprehensive look at the specific requirements, scope, and impact of each standard.
DORA Details
What It Is
The Digital Operational Resilience Act (DORA), formally Regulation (EU) 2022/2554, is a transformative EU regulation enhancing digital operational resilience for the financial sector against ICT disruptions like cyberattacks and third-party failures. Enacted in 2022 and applying from January 17, 2025, it covers 20 financial entity types and critical ICT third-party providers (CTPPs), using a risk-based, proportional approach to harmonize rules across member states.
Key Components
DORA's pillars include ICT risk management frameworks with vulnerability controls and continuity plans; incident reporting with 4/72-hour timelines; resilience testing via annual scans and triennial TLPT; and third-party oversight with due diligence and ESAs supervision. It mandates management oversight, annual reviews, and penalties up to 2% of global turnover.
Why Organizations Use It
Financial firms adopt DORA for legal compliance amid rising threats (74% ransomware hit rate), to mitigate systemic risks shown in CrowdStrike outage, improve resilience, foster information sharing, and gain trust from regulators/stakeholders in a tech-dependent ecosystem.
Implementation Overview
Entities conduct gap analyses against RTS/ITS, develop frameworks, implement testing/monitoring tools, and assess vendors. Proportional to size/complexity, it targets EU finance; compliance via authority audits, with preparation urged pre-2025 deadline. (178 words)
EN 1090 Details
What It Is
EN 1090 is the harmonized European standard family (EN 1090-1, -2, -3) for execution and conformity assessment of structural steel and aluminium components. It implements the EU Construction Products Regulation (CPR), enabling CE marking via a risk-based approach through Execution Classes (EXC1–EXC4).
Key Components
- **EN 1090-1Conformity assessment, Factory Production Control (FPC) certification by Notified Bodies.
- **EN 1090-2/-3Technical rules for steel/aluminium (welding, tolerances, corrosion protection, inspection/NDT).
- Core principles: Material traceability, ISO 3834 welding quality, risk-scaled controls.
- AVCP systems with ongoing surveillance.
Why Organizations Use It
- Mandatory for EU market access with CE marking.
- Reduces liability, rework; builds trust via certified quality.
- Strategic: Enables high-risk projects (EXC3/4), competitive bidding.
Implementation Overview
Phased: Gap analysis, FPC build, welding quals, NB certification (3–12 months). Applies to fabricators in construction; requires audits, training for all sizes.
Key Differences
| Aspect | DORA | EN 1090 |
|---|---|---|
| Scope | Digital operational resilience in finance | Execution of steel/aluminium structural components |
| Industry | EU financial sector only | EU construction/manufacturing |
| Nature | Mandatory EU regulation | Harmonized standard for CE marking |
| Testing | Annual basic + triennial TLPT | FPC certification + surveillance audits |
| Penalties | Up to 2% global turnover fines | Market exclusion, no CE marking |
Scope
Industry
Nature
Testing
Penalties
Frequently Asked Questions
Common questions about DORA and EN 1090
DORA FAQ
EN 1090 FAQ
You Might also be Interested in These Articles...
Top 10 Reasons ISO 27701 is the Ultimate Privacy Boost for Your ISO 27001 ISMS in 2025
Extend ISO 27001 with ISO 27701 for ultimate privacy governance amid GDPR & AI regs. Discover top 10 advantages like integrated audits to future-proof your ISMS
Beyond Reactive: Transforming Compliance into Real-Time Threat Prevention
Discover how modern compliance monitoring tools leverage continuous, real-time oversight and automated alerts to shift organizations from reactive problem-solving to proactive threat detection and prevention, safeguarding against emerging risks before they escalate.
ISO 27701 Implementation Roadmap: Extending Your ISMS to PIMS in 12 Months or Less
Extend ISO 27001 ISMS to ISO 27701 PIMS in 12 months with our phased roadmap. Templates, checklists & infographics for RoPA, DSARs & audit-ready privacy complia
Run Maturity Assessments with GRADUM
Transform your compliance journey with our AI-powered assessment platform
Assess your organization's maturity across multiple standards and regulations including ISO 27001, DORA, NIS2, NIST, GDPR, and hundreds more. Get actionable insights and track your progress with collaborative, AI-powered evaluations.
Check out these other Gradum.io Standards Comparison Pages
FERPA vs UAE PDPL
Discover FERPA vs UAE PDPL: US student privacy law meets UAE data protection. Compare rights, consents, disclosures & compliance strategies for educators worldwide.
PCI DSS vs CSL (Cyber Security Law of China)
PCI DSS vs CSL (Cyber Security Law of China): Compare key requirements, compliance strategies, data rules & penalties. Secure payments & China ops—expert insights now!
IFS Food vs CMMI
Compare IFS Food vs CMMI: Key differences in food safety audits, process maturity levels, and certification strategies for manufacturers. Boost compliance, efficiency—choose wisely now!