--- title: DORA is live, and every pillar assumes you can see your... description: DORA (Digital Operational Resilience Act) has been in force across the EU since January 2025, covering over 22,000 financial entities. The regulation's five... canonical: https://daily.dev/posts/dora-is-live-and-every-pillar-assumes-you-can-see-your-infrastructure-cflgdq3fn twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: DORA is live, and every pillar assumes you can see your infrastructure | daily.dev og:description: DORA (Digital Operational Resilience Act) has been in force across the EU since January 2025, covering over 22,000 financial entities. The regulation's five... og:url: https://daily.dev/posts/dora-is-live-and-every-pillar-assumes-you-can-see-your-infrastructure-cflgdq3fn og:image: https://api.daily.dev/og/posts/CflGdq3Fn.png og:image:alt: DORA is live, and every pillar assumes you can see your infrastructure og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # DORA is live, and every pillar assumes you can see your infrastructure **[NetBox Labs](https://daily.dev/sources/netboxlabs)** · 8 min read · 0 upvotes · 0 comments ## Summary DORA (Digital Operational Resilience Act) has been in force across the EU since January 2025, covering over 22,000 financial entities. The regulation's five pillars — ICT risk management, incident reporting, resilience testing, third-party risk management, and information sharing — all depend on having an accurate, continuously updated picture of your ICT estate. Key pressure points include a strict 4h/72h/1-month incident reporting cadence that leaves no time for scope discovery, an annually submitted Register of Information on third-party ICT arrangements that rots if treated as a static spreadsheet, and continuous resilience testing that requires an always-accurate asset map. The core argument is that DORA compliance fails at the infrastructure layer when organisations lack a live, queryable system of record for assets, dependencies, and business-function mappings. The post also promotes NetBox Labs' platform and its Validation feature as tools that address these obligations through continuous discovery and policy checking. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### When did the DORA regulation actually take effect in the EU? Regulation (EU) 2022/2554, the Digital Operational Resilience Act, has applied directly across the EU since January 17, 2025, with no national transposition step required. It covers more than 22,000 financial entities EU-wide plus the ICT third parties serving them, including cloud, colocation, connectivity, managed security, and software vendors behind critical functions. _Teams tracking regulatory deadlines like this one follow infrastructure and compliance news on daily.dev._ ### What is the DORA incident reporting timeline for major ICT incidents? The clock starts at classification, not detection: an initial notification is due within 4 hours of classifying an incident as major, and no later than 24 hours from detection. An intermediate report follows within 72 hours, and a final report with root-cause analysis, financial impact, and remediation is due within one month of the intermediate report. _Engineers building incident response processes around tight regulatory clocks track these details on daily.dev._ ### What penalties can financial entities and ICT providers face for DORA non-compliance? Financial entities can face administrative penalties commonly cited as up to 2% of total annual worldwide turnover, with the exact regime left to national authorities. Critical ICT third parties under the oversight regime face periodic penalty payments up to 1% of average daily worldwide turnover, which can be levied daily for as long as six months. _Anyone weighing compliance investment against regulatory risk finds DORA penalty details useful on daily.dev._ ## Similar posts on daily.dev - [DORA and the Practical Test of Operational Resilience](https://daily.dev/posts/dora-and-the-practical-test-of-operational-resilience-ciqlbtvj8) · IT Security Guru · 0 upvotes · 0 comments - [DORA penetration testing and threat-led exercises explained](https://daily.dev/posts/dora-penetration-testing-and-threat-led-exercises-explained-dlodpz8lb) · Security Boulevard · 0 upvotes · 0 comments - [When DORA Goes From Afterthought to Commercial Imperative](https://daily.dev/posts/when-dora-goes-from-afterthought-to-commercial-imperative-ukjrnq0ec) · IT Security Guru · 0 upvotes · 0 comments - [DORA, NIS2, and the End of ‘We’re Not in Scope’](https://daily.dev/posts/dora-nis2-and-the-end-of-we-re-not-in-scope--5rh4p6xbr) · Security Boulevard · 0 upvotes · 0 comments - [DORA and operational resilience: Credential management as a financial risk control](https://daily.dev/posts/dora-and-operational-resilience-credential-management-as-a-financial-risk-control-lru0rb4no) · BleepingComputer · 0 upvotes · 0 comments --- Tags: [#infrastructure](https://daily.dev/tags/infrastructure), [#networking](https://daily.dev/tags/networking), [#compliance](https://daily.dev/tags/compliance), [#dora](https://daily.dev/tags/dora) [View this post on daily.dev](https://daily.dev/posts/dora-is-live-and-every-pillar-assumes-you-can-see-your-infrastructure-cflgdq3fn) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"DORA is live, and every pillar assumes you can see your infrastructure","url":"https://daily.dev/posts/dora-is-live-and-every-pillar-assumes-you-can-see-your-infrastructure-cflgdq3fn","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/dora-is-live-and-every-pillar-assumes-you-can-see-your-infrastructure-cflgdq3fn"},"datePublished":"2026-07-29T19:55:42.758Z","dateModified":"2026-09-13T21:32:26.763Z","description":"DORA (Digital Operational Resilience Act) has been in force across the EU since January 2025, covering over 22,000 financial entities. The regulation's five...","image":"https://media.daily.dev/image/upload/s--1KxV4ohY--/f_auto/v1722860400/public/Placeholder%2007","thumbnailUrl":"https://media.daily.dev/image/upload/s--1KxV4ohY--/f_auto/v1722860400/public/Placeholder%2007","isAccessibleForFree":true,"articleSection":"NetBox Labs","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"NetBox Labs","logo":"https://media.daily.dev/image/upload/s--d8rcv4eT--/f_auto/v1728807741/logos/netboxlabs","url":"https://daily.dev/sources/netboxlabs"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/dora-is-live-and-every-pillar-assumes-you-can-see-your-infrastructure-cflgdq3fn","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"infrastructure,networking,compliance,dora","timeRequired":"PT8M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"NetBox Labs","item":"https://daily.dev/sources/netboxlabs"},{"@type":"ListItem","position":3,"name":"DORA is live, and every pillar assumes you can see your infrastructure"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/dora-is-live-and-every-pillar-assumes-you-can-see-your-infrastructure-cflgdq3fn#faq","mainEntity":[{"@type":"Question","name":"When did the DORA regulation actually take effect in the EU?","acceptedAnswer":{"@type":"Answer","text":"Regulation (EU) 2022/2554, the Digital Operational Resilience Act, has applied directly across the EU since January 17, 2025, with no national transposition step required. It covers more than 22,000 financial entities EU-wide plus the ICT third parties serving them, including cloud, colocation, connectivity, managed security, and software vendors behind critical functions. Teams tracking regulatory deadlines like this one follow infrastructure and compliance news on daily.dev."}},{"@type":"Question","name":"What is the DORA incident reporting timeline for major ICT incidents?","acceptedAnswer":{"@type":"Answer","text":"The clock starts at classification, not detection: an initial notification is due within 4 hours of classifying an incident as major, and no later than 24 hours from detection. An intermediate report follows within 72 hours, and a final report with root-cause analysis, financial impact, and remediation is due within one month of the intermediate report. Engineers building incident response processes around tight regulatory clocks track these details on daily.dev."}},{"@type":"Question","name":"What penalties can financial entities and ICT providers face for DORA non-compliance?","acceptedAnswer":{"@type":"Answer","text":"Financial entities can face administrative penalties commonly cited as up to 2% of total annual worldwide turnover, with the exact regime left to national authorities. Critical ICT third parties under the oversight regime face periodic penalty payments up to 1% of average daily worldwide turnover, which can be levied daily for as long as six months. Anyone weighing compliance investment against regulatory risk finds DORA penalty details useful on daily.dev."}}]} ```