Point of View · Operational resilience
DORA: from compliance to demonstrated resilience
The regulation demands less documentation than capability: proving that critical services hold.
ESA Alliance
· 6 min read
The documentation trap
Many institutions treated DORA as a mapping and policy exercise. Necessary, but not sufficient: supervisors expect proven resilience, not described resilience.
Start from critical services
The right unit of analysis is not the application but the service delivered to clients. Identifying critical services, their dependencies and impact tolerances structures everything else.
Govern third parties as a first-order risk
Dependence on technology providers has become a board-level risk. Contracts, exit plans and joint testing must reach the risk committee.