Thoughts, articles, and resources on software development, SaaS, and digital growth.
DORA has been in full application since January 2025. A static checklist got you through initial implementation. Continuous monitoring of implementing acts, supervisory guidance, and third-party risk developments is what keeps you there. This article explains the difference and what tools actually serve each need.
A retrospective and forward looking timeline of DORA's implementation, from entry into force through the 2026 shift into active supervision, with a self assessment prompt at every milestone so compliance teams can check their own progress against the regulatory clock.
Both DORA and NIS2 apply to EU financial firms, but they do not apply equally or in the same way. This article explains the relationship between the two frameworks, where they overlap, where DORA takes precedence, and what financial firms need to do about the residual gap.
DORA's third-party risk requirements are not about having the right contracts in place. They are about being able to prove, on demand, that your vendor relationships are understood, monitored, and controlled. Most firms are not ready for that question.
The Digital Operational Resilience Act sets binding requirements for ICT risk management, incident reporting, resilience testing, and third-party oversight across EU financial services. This checklist covers the core obligations and what meeting them looks like in practice.