How long does the transition to DORA take?

How long does DORA implementation take?

It mainly depends on size, maturity and the number of ICT service providers: small companies with an ISO 27001 foundation often complete implementation in 3 to 6 months, mid-sized institutions in 6 to 9 months, and large banks and insurers need 9 to 15 months. The biggest time sink is almost always adapting contracts with ICT service providers. These figures are experience-based estimates from projects, not legal deadlines.

The Digital Operational Resilience Act (DORA) has applied since 17 January 2025 (Regulation (EU) 2022/2554). Even so, many companies are not finished yet: latecomers are closing gaps, new financial entities are entering the market and ICT service providers have to meet their financial customers’ requirements. This article shows what project duration you should realistically expect and how to structure the timeline.

Who needs to know how long DORA implementation takes?

DORA applies to 20 types of financial entities – from banks and insurers to payment and e-money institutions and crypto-asset service providers – and indirectly to their ICT service providers. Find out exactly who is affected in our article Who is required to comply with DORA?

The project duration is particularly relevant for three groups:

• Latecomers who have not yet fully implemented DORA and need to close gaps before the next supervisory review.
• New market entrants, such as FinTechs with a new licence, who must comply with DORA from the start.
• ICT service providers whose financial customers require evidence, audit rights and contract amendments under Art. 30 DORA.

How long does DORA take depending on company size and maturity?

The project duration depends heavily on your starting point. If you already operate an information security management system based on ISO 27001, you save months of groundwork. Typical timeframes from practice:

What are the phases of DORA implementation?

A phased model makes the timeline plannable. In practice, the phases partly run in parallel – which is why the total duration is shorter than the sum of the individual phases.

Phase 1: Scoping and gap analysis (1–2 months)

At the start, you compare your current state with DORA and the regulatory and implementing technical standards (RTS/ITS) of the European Supervisory Authorities.

• Core tasks: inventory of ICT assets and business processes, recording all ICT service providers, review of existing policies.
• Time sinks: incomplete or outdated IT inventories often delay this step by several weeks.

Phase 2: Frameworks and policies (2–3 months)

In this phase, the DORA frameworks are developed.

• Core tasks: ICT risk management framework, business continuity and recovery plans, process for classifying and reporting ICT incidents.
• Time sinks: coordination and approval loops with management, which bears ultimate responsibility under Art. 5 DORA.

Phase 3: Contracts and register of information (2–4 months)

In practice, this phase is usually the biggest time sink.

• Core tasks: setting up the register of information under Art. 28(3) DORA and amending contracts under Art. 30 DORA (audit rights, service levels, exit strategies).
• Time sinks: negotiations with large international cloud providers or software vendors who want to impose their own contract templates.

Phase 4: Implementation and testing (2–3 months)

Now the requirements are put into day-to-day practice.

• Core tasks: technical safeguards (e.g. logging and monitoring, multi-factor authentication), vulnerability assessments and penetration tests, training for employees and management.
• Time sinks: procuring and setting up new security tools and scheduling management training.

Phase 5: Readiness check (approx. 1 month)

Finally, you check that everything works.

• Core tasks: simulating an incident report, checking that all evidence is complete, sign-off by management.

What influences the project duration most?

Why do some companies need three months and others more than a year? Three factors make the difference:

1. Complexity of the supply chain

A company with five core cloud services can amend its contracts within a few weeks. An institution with more than 150 ICT service providers has to review, renegotiate and record hundreds of contracts in the register of information. Structured vendor risk management shortens this phase considerably.

2. Availability of internal resources

Without dedicated project capacity, IT and security teams handle DORA “on the side”. Experience shows this extends the project duration significantly.

3. Existing standards and tools

If you already operate an ISMS based on ISO 27001, you mainly need to close gaps rather than start from scratch. Find out whether certification is worthwhile in our article ISO 27001: Which companies benefit from certification? Maintaining contracts, risks and registers in spreadsheets, on the other hand, costs a lot of time.

How can you speed up DORA implementation?

When time pressure rises, these levers help – without compromising on quality:

1. Use existing standards: Build on ISO 27001 or IT-Grundschutz and only add the DORA-specific gaps instead of rewriting everything.
2. Standardise contract amendments: Work with a uniform DORA contract addendum that covers all mandatory content under Art. 30, and prioritise providers supporting critical or important functions.
3. Keep the register of information digitally: Use software that maps and exports the register in the format of the implementing technical standards (ITS).
4. Digitise training: E-learning modules make the regular training of employees and management easier (Art. 5(4) DORA).
5. Manage the project tightly: Set clear milestones and involve legal, IT and information security in short, regular check-ins.

Our guide NIS2 vs. DORA explains the difference from NIS2 and which rules take precedence for you.

Example: timeline for a small FinTech

A fictional example: a FinTech with 50 employees, cloud IT, ISO 27001 in place and 22 ICT service providers.

• Month 1: gap analysis and recording of all 22 ICT service providers.
• Month 2: updating the ICT risk framework and the incident response manual.
• Month 3: sending DORA contract addenda to service providers, management training.
• Month 4: populating the register of information and penetration test.
• Month 5: simulating an incident report and sign-off by management.

Total duration: around 5 months to full implementation.

Conclusion: reaching the goal with realistic planning

How long DORA implementation takes cannot be answered across the board, but it can be planned well: depending on size and starting point, 3 to 15 months is realistic, often less for ICT service providers. Because DORA already applies, latecomers should not lose any time.

The most effective levers are existing standards such as ISO 27001, standardised contract addenda and a digitally managed register of information.

With heyData’s vendor risk management, you record your ICT service providers, review contracts and manage your register of information in one place.

Take the first step: Book a free demo now