What is the primary objective of DORA?

The primary objective of DORA is to strengthen the digital operational resilience of the EU financial sector against ICT disruptions, including cyberattacks, system failures, and third-party risks. Regulation (EU) 2022/2554 mandates proactive ICT risk management, incident reporting, resilience testing, and third-party oversight for 20 types of financial entities and critical ICT third-party providers (CTPPs), which entered full application on January 17, 2025.

Who is legally or professionally required to comply with DORA?

DORA legally requires compliance from approximately 22,000 EU-regulated financial entities across 20 types, including credit institutions, insurance undertakings, investment firms, payment institutions, and crypto-asset service providers, plus designated critical ICT third-party providers (CTPPs). It applies proportionally based on size, complexity, and risk, with ESAs having designated CTPPs like cloud providers by end-2025 for direct oversight.

Does DORA require an external audit or third-party certification?

DORA does not mandate external audits or third-party certification but requires independent digital operational resilience testing, including annual basic tests and triennial threat-led penetration testing (TLPT) for critical entities. Testing must validate ICT protections, with results reported to authorities; third-party oversight includes contractual audit rights for CTPPs, per Batch 2 RTS/ITS published July 17, 2024.

How often should an assessment for DORA be performed?

DORA mandates annual basic ICT resilience tests for all in-scope entities and triennial advanced threat-led penetration testing (TLPT) for critical or designated entities. ICT risk management frameworks require annual reviews, with incident response and third-party risk assessments conducted ongoing or as risks evolve, aligned with proportionality principles.

What are the consequences of non-compliance with DORA?

Non-compliance with DORA can result in administrative fines up to 2% of total global annual turnover for firms or €5 million (or 10% of annual salary) for individuals, imposed by ESAs or competent authorities. Additional penalties include oversight fees up to €1 million annually for CTPPs, remediation orders, and public censure, effective from January 17, 2025.

An DORA be mapped to other international frameworks?

Yes, DORA's ICT risk management, incident reporting, testing, and third-party oversight pillars can be mapped to other international frameworks, leveraging existing structures like EBA 2019 guidelines for evolution. Financial entities often align DORA's proportionality, 4-hour reporting, and TLPT requirements with global standards for streamlined compliance.

What is the first step to begin implementing DORA?

The first step to implement DORA is to conduct a gap analysis against the ICT risk management framework RTS published January 17, 2024, identifying deficiencies in ICT strategies, incident classification, and third-party dependencies. Establish management body oversight and prioritize proportional controls for critical services with recovery time objectives under 4 hours established by the January 17, 2025 deadline.

What is the primary objective of ISO 28000?

ISO 28000 specifies requirements for establishing, implementing, maintaining, and continually improving a security management system (SMS) for supply chain security. The 2022 edition provides a risk-based framework to identify, assess, and treat security risks across people, assets, goods, infrastructure, and information in supply chains, using a PDCA cycle aligned with the High Level Structure for systemic protection and resilience.

Who is legally or professionally required to comply with ISO 28000?

No organizations are legally required to comply with ISO 28000, as it is a voluntary international standard. Professionally, it applies to any size or type of organization—micro-enterprises to multinationals—in logistics, manufacturing, retail, pharmaceuticals, energy, ports, or government, where supply chain security is a priority via contracts, tenders, insurance, or trade programs like C-TPAT equivalents.

Oes ISO 28000 require an external audit or third-party certification?

ISO 28000 does not require external audit or third-party certification, which is optional for demonstrating conformity. Organizations may pursue certification via accredited bodies per ISO 28003, involving Stage 1 (documentation) and Stage 2 (implementation) audits, followed by surveillance, but internal audits and self-declaration suffice for compliance.

How often should an assessment for ISO 28000 be performed?

ISO 28000 requires risk assessments to be maintained and reviewed at planned intervals or when significant changes occur. Internal audits occur via a risk-based program at planned intervals; management reviews happen periodically (typically annually); continual improvement demands ongoing monitoring of KPIs, incidents, and nonconformities.

What are the consequences of non-compliance with ISO 28000?

Non-compliance with ISO 28000 carries no direct legal penalties, as it is voluntary. Indirect consequences include supply chain disruptions from theft, sabotage, or incidents; lost contracts or tenders requiring security credentials; higher insurance premiums; regulatory scrutiny in trade programs; reputational damage; and operational costs from unmitigated risks.

An ISO 28000 be mapped to other international frameworks?

Yes, ISO 28000:2022 aligns with the ISO High Level Structure, enabling mapping to frameworks sharing PDCA and clauses 4-10. Its risk-based approach per ISO 31000 supports integration with complementary systems, allowing unified audits, shared risk registers, and governance without violating its standalone requirements.

What is the first step to begin implementing ISO 28000?

The first step is to determine the organization's context, interested parties, and SMS scope per Clause 4. Conduct supply chain mapping, identify internal/external issues and requirements, appoint leadership sponsorship, and produce a gap analysis against clauses to baseline current state and prioritize actions.

Standards Comparison

DORA vs ISO 28000

DORA

Mandatory

2023

EU regulation for digital operational resilience in financial sector

ISO 28000

Voluntary

2022

International standard for supply chain security management systems.

Quick Verdict

DORA mandates digital resilience for EU finance against ICT risks via testing and reporting, while ISO 28000 offers voluntary supply chain security frameworks globally. Firms adopt DORA for regulatory compliance; ISO 28000 for resilience, certification, and market advantage.

Digital Operational Resilience

DORA

Regulation (EU) 2022/2554

Cost

€€€€

Complexity

Medium

Implementation Time

18-24 months

Supply Chain Security

ISO 28000

ISO 28000:2022 Security management systems Requirements

Cost

€€€€

Complexity

High

Implementation Time

12-18 months

Key Features

Risk-based supply chain security assessment and treatment
PDCA cycle for continual SMS improvement
Supplier and third-party security governance
Integration with ISO 22301 and 27001 standards
Incident response and recovery planning

Detailed Analysis

A comprehensive look at the specific requirements, scope, and impact of each standard.

DORA Details

What It Is

Digital Operational Resilience Act (DORA), formally Regulation (EU) 2022/2554, is a transformative EU regulation. It mandates digital operational resilience for the financial sector against ICT disruptions like cyberattacks and third-party failures. Applicable to 20 financial entity types and critical ICT third-party providers (CTPPs) across 27 member states, it uses a risk-based, proportional approach focusing on proactive strategies over reactive measures.

Key Components

Core pillars include ICT risk management frameworks for identifying and mitigating risks; standardized incident reporting with 4-hour notifications; resilience testing via annual scans and triennial threat-led penetration testing (TLPT); and third-party oversight with due diligence and ESAs supervision of CTPPs. Proportionality tailors requirements to entity size and risk profile, with no formal certification but strict compliance enforcement.

Why Organizations Use It

Financial entities comply to meet legal obligations enforced since the January 2025 deadline, avoiding fines up to 2% of global turnover. It mitigates systemic cyber risks (74% perceive as top threat), enhances resilience post-incidents like CrowdStrike outage, builds stakeholder trust, and drives cybersecurity innovation amid €10-15B EU spend.

Implementation Overview

Involves gap analyses against RTS/ITS, framework development, testing programs, and vendor monitoring. Targets ~22,000 entities; larger firms leverage existing setups, SMEs face challenges. Ongoing ESAs oversight with Batch 1/2 standards guides compliance following the 2025 rollout.

ISO 28000 Details

What It Is

ISO 28000:2022 is an international management system standard specifying requirements for establishing, implementing, maintaining, and improving a security management system (SMS) focused on supply chain security and resilience. It adopts a risk-based approach using the PDCA cycle, aligned with ISO High Level Structure.

Key Components

Clauses cover context, leadership, planning, support, operation, performance evaluation, and improvement.
Emphasizes risk assessment, security strategies, incident response, supplier controls, and continual improvement.
Built on ISO 31000 risk principles and integrates with ISO 22301, ISO 27001.
Optional third-party certification via accredited bodies per ISO 28003.

Why Organizations Use It

Mitigates supply chain risks like theft, sabotage, disruptions.
Meets contractual, regulatory, trade facilitation needs.
Reduces incidents, insurance costs; enhances market access, reputation.
Builds stakeholder trust through auditable governance.

Implementation Overview

Phased: scoping, gap analysis, risk assessment, controls deployment, audits, certification.
Scalable for all sizes/industries (logistics, manufacturing, pharma).
Global applicability; involves training, supplier engagement, KPIs monitoring.

Key Differences

Aspect	DORA	ISO 28000
Scope	Digital operational resilience in finance	Supply chain security management systems
Industry	EU financial entities and ICT providers	All industries worldwide, supply chain focused
Nature	Mandatory EU regulation with enforcement	Voluntary international certification standard
Testing	Annual basic tests, triennial TLPT	Internal audits, management reviews, certification audits
Penalties	Up to 2% global turnover fines	Loss of certification, no legal penalties

Scope

DORA

Digital operational resilience in finance

ISO 28000

Supply chain security management systems

Industry

DORA

EU financial entities and ICT providers

ISO 28000

All industries worldwide, supply chain focused

Nature

DORA

Mandatory EU regulation with enforcement

ISO 28000

Voluntary international certification standard

Testing

DORA

Annual basic tests, triennial TLPT

ISO 28000

Internal audits, management reviews, certification audits

Penalties

DORA

Up to 2% global turnover fines

ISO 28000

Loss of certification, no legal penalties

Frequently Asked Questions

Common questions about DORA and ISO 28000

DORA FAQ

ISO 28000 FAQ

You Might also be Interested in These Articles...

The Panoramic View: How Integrated Compliance Monitoring Creates Unprecedented Organizational Visibility and Adaptability

Gain unprecedented organizational visibility with integrated compliance monitoring. Automate real-time alerts, ensure GDPR & SOC 2 adherence, reduce risks, and

ISO 27701 2025 Update: Navigating Standalone Certification Myths, Audit Realities, and a 90-Day PIMS Launch Plan

Debunk ISO 27701 2025 standalone certification myths vs ISO 27001. Get a 90-day PIMS launch roadmap, checklists & audit prep to certify faster amid global priva

Top 5 Unseen Complexities Modern Compliance Software Effortlessly Manages

Uncover top 5 unseen complexities modern compliance software manages effortlessly—from sensitive data mapping to real-time regulatory shifts. Automate audits, i

Run Maturity Assessments with GRADUM

Transform your compliance journey with our AI-powered assessment platform

Assess your organization's maturity across multiple standards and regulations including ISO 27001, DORA, NIS2, NIST, GDPR, and hundreds more. Get actionable insights and track your progress with collaborative, AI-powered evaluations.

100+ Standards & Regulations

AI-Powered Insights

Collaborative Assessments

Actionable Recommendations

Explore More Comparisons

See how DORA and ISO 28000 compare against other standards

Other DORA Comparisons

Other ISO 28000 Comparisons

What It Is

Key Components

Why Organizations Use It

What It Is

Key Components

Clauses cover context, leadership, planning, support, operation, performance evaluation, and improvement.

Emphasizes risk assessment, security strategies, incident response, supplier controls, and continual improvement.

Built on ISO 31000 risk principles and integrates with ISO 22301, ISO 27001.

Optional third-party certification via accredited bodies per ISO 28003.

Aspect

DORA

ISO 28000

Scope

Digital operational resilience in finance

Supply chain security management systems

Industry

EU financial entities and ICT providers

All industries worldwide, supply chain focused

Nature

Mandatory EU regulation with enforcement

Voluntary international certification standard

Testing

Annual basic tests, triennial TLPT

Internal audits, management reviews, certification audits

Penalties

Up to 2% global turnover fines

Loss of certification, no legal penalties