DORA requirements for the SOC: what the Digital Operational Resilience Act means in operations

DORA is the sector-specific lex specialis for the EU financial sector and largely takes precedence over NIS2. Non-financial subsidiaries remain under NIS2, see NIS2 for Swiss subsidiaries. For Swiss supervision, FINMA Circular 2023/1 remains authoritative, see SOC & FINMA requirements. For the Swiss critical-infrastructure reporting duty, see SOC & ISG 24h reporting. For the banking angle, see SOC for banks. For operations, see SOC as a Service Switzerland.

DORA does not use a NIS2-style flat employee or turnover threshold. Applicability hinges on financial-sector authorisation. Any entity licensed as an EU financial firm is in scope. Proportionality depends on the specific entity type and its individual size, not a single threshold.

• DORA covers EU subsidiaries of Swiss groups holding one of the 20 authorisations listed in the regulation. These include credit institutions, payment institutions, e-money institutions, investment firms, crypto-asset service providers, insurers and reinsurers, and insurance intermediaries. They also include alternative investment fund managers, UCITS management companies, data-reporting service providers, central counterparties, trading venues, trade repositories, central securities depositaries and others.
• A simplified framework applies to microenterprises and small, non-interconnected investment firms. It also applies to certain small insurers under Solvency II Art. 4. Core duties remain, with reduced detail requirements.
• Contractual reach-through: Swiss ICT providers to EU financial customers inherit the DORA contract clauses (Art. 30), including access, audit and termination rights and concentration-risk considerations.
• The Lead Overseer directly oversees critical ICT third-party providers (CTPPs) designated by the European Supervisory Authorities.

1. Classification: the RTS criteria (Art. 18) assess an ICT incident across seven dimensions. These cover affected clients, data loss, reputation, duration, geographical spread, economic impact and criticality of services. An incident qualifies as major if it exceeds the thresholds.
2. Initial notification: within 4 hours of classification as major, and no later than 24 hours after becoming aware of the incident, to the competent authority.
3. Intermediate report: within 72 hours of the initial notification, with an update on cause, impact and mitigations.
4. Final report: within one month of the intermediate report, with root-cause analysis and lessons learned.
5. Voluntary notification of significant cyber threats: possible when relevant to clients or the market.

DORA requires threat-led penetration testing (TLPT) at least every three years for significant entities. Tests require realistic threat intelligence, clearly separated red and blue teams, and supervisory oversight. The methodology is closely aligned with TIBER-EU. During the test the SOC is the blue team and must deliver detection and response without prior warning. On red team versus pentest, see Red team assessment and Penetration testing Switzerland.

• Only the institution's white cell knows about the test. The SOC operates in real-incident mode.
• The exercise closes with a purple-team workshop covering detection gaps, timeline and re-tuning.
• Results feed as evidence into supervisory reporting and into the next ICT risk assessment.

• Complete register of all ICT service providers with a criticality assessment, filed annually with the competent authority in a harmonised format.
• DORA contract clauses (Art. 30) with access, audit, sub-outsourcing and termination rights, plus an exit strategy for critical services.
• Concentration-risk analysis: no uncontrolled clustering with individual providers, cloud regions or group structures.
• SOC contribution: detection on provider access, log ingestion from critical providers, alerting on anomalies in cloud and managed-service channels.

1. Current ICT risk framework with management-body approval and at least an annual review.
2. Detection use-case catalogue mapped to DORA-relevant incident categories and to MITRE ATT&CK.
3. Classification decision tree with documented examples and a post-incident review per case.
4. ICT third-party register, kept current, with criticality and concentration assessments.
5. Testing programme with annual baseline tests and a TLPT cycle every three years including evidence.
6. Reporting lines to executive management and the supervisory body with frequency, content and training records.

For the economics, see SOC cost Switzerland and SOC ROI. For the 24/7 rationale, see SOC 24/7 operations. For the MTTD/MTTR metrics, see MTTD and MTTR in a SOC.

SOC as a Service Switzerland describes how DORA-ready operations work within an ongoing SOC service.

• FINMA Guidance 05/2020 on reporting cyber attacks (Art. 29 para. 2 FINMASA): finma.ch
• FINMA Guidance 03/2024 refining the reporting duty: finma.ch
• FINMA Circular 2023/1 «Operational risks and resilience»: finma.ch
• FINMASA (SR 956.1): Fedlex
• ISG reporting duty at the National Cyber Security Centre (NCSC) including routing: bacs.admin.ch
• Reporting data security breaches to the FDPIC: edoeb.admin.ch
• DORA (EU) 2022/2554, official overview: EIOPA