What are the DORA EBA guidelines? Understanding the technical requirements

What are the DORA EBA guidelines?

“DORA EBA guidelines” usually refers to the Level 2 acts under DORA: regulatory technical standards (RTS) and implementing technical standards (ITS). The European Supervisory Authorities EBA, ESMA and EIOPA drafted them jointly, and the European Commission adopted them as delegated and implementing regulations. They apply directly and specify the requirements of the DORA regulation, which has applied since 17 January 2025. Guidelines in the narrower sense also exist, for example on estimating the costs and losses of major incidents. As of November 2026.

Regulation (EU) 2022/2554 (DORA) sets out the principles of digital operational resilience in the financial sector. How encryption, incident reporting, penetration testing or the register of ICT contracts must look in detail is only set out in the technical standards. For an overview of DORA as a whole, see our article DORA: overview, requirements and implementation.

How do RTS, ITS and guidelines differ?

The three instruments differ in who adopts them and how binding they are:

In Germany, BaFin supervises compliance with DORA for most financial entities.

Which RTS and ITS exist under DORA?

These legal acts have been published in the Official Journal of the EU and apply:

What does the RTS on ICT risk management require technically?

Delegated Regulation (EU) 2024/1774 sets out the policies, procedures and safeguards financial entities must implement. Key technical requirements include:

• Encryption and cryptography: a policy on encrypting data at rest and in transit and, where relevant, in use, plus structured key management.
• Access control: access rights based on need-to-know and least privilege, and strong authentication based on risk, especially for privileged and remote access.
• Network security: network segmentation and separation of the production environment from development and test environments.
• Vulnerability and patch management: identifying, assessing and remediating vulnerabilities promptly.
• Logging and detection: recording and analysing events and detecting anomalous activity.

Under Art. 16 DORA, a simplified framework applies to certain financial entities, such as small and non-interconnected investment firms and exempted payment and e-money institutions. Our article Who is required to comply with DORA? shows whether your company is one of them.

When is an ICT incident major under DORA?

Under Delegated Regulation (EU) 2024/1772, an incident is major if it affects critical services and one of two further conditions is met: there was malicious unauthorised access to network and information systems that may result in data losses, or at least two other thresholds are exceeded. The criteria include:

• Clients, counterparts and transactions affected: for example more than 10% of the clients using the service, or more than 100,000 clients.
• Duration and service downtime: the incident lasts more than 24 hours or critical services are down for more than two hours.
• Geographical spread: impact in at least two Member States.
• Data losses: impact on the availability, authenticity, integrity or confidentiality of data.
• Reputational impact and economic impact, for example direct and indirect costs of more than EUR 100,000.

Practical example: DDoS attack on online banking

Fictional example: a DDoS attack takes a bank’s online banking offline for 45 minutes. 12% of the clients using online banking are affected. No data is lost, there is no media coverage, and the impact is limited to one country.

• Critical service affected? Yes, online banking is a critical service.
• Malicious access with data loss? No, the attack overloaded systems but did not gain access.
• Other thresholds: only the threshold for affected clients is exceeded. Downtime, data losses, geographical spread and reputation remain below.

Result: only one further threshold is met, so the incident is not major and not reportable. You still document it and reassess the classification if the situation changes, for example due to media coverage or a longer outage. The example does not replace an assessment of the individual case.

Which reporting deadlines apply to major incidents?

Delegated Regulation (EU) 2025/301 sets three reporting stages to the competent authority, in Germany usually BaFin:

• Initial notification: within 4 hours of classifying the incident as major, and no later than 24 hours after becoming aware of it.
• Intermediate report: within 72 hours of the initial notification.
• Final report: within one month of the latest intermediate report.

The forms are set out in Implementing Regulation (EU) 2025/302. Our DORA vs. NIS2 comparison shows how these obligations differ from NIS2.

What does the register of information cover?

Implementing Regulation (EU) 2024/2956 sets uniform templates for the register of information. It records all contractual arrangements on ICT services, including the subcontractors supporting critical or important functions. Supervisors request the register, so it must be complete and up to date. You can read which other evidence DORA requires in Which documents are required for DORA compliance?.

What applies to threat-led penetration testing (TLPT)?

Only financial entities designated by the supervisor must carry out TLPT, at least every three years. Delegated Regulation (EU) 2025/1190 is based on the European TIBER-EU framework. It sets out who must test, the scope and method, and the requirements for testers, such as expertise, references and professional indemnity insurance. Internal testers are allowed under certain conditions, but under DORA external testers must be used for every third test.

How do you implement the technical standards in your IT?

1. Gap analysis against the RTS on risk management: check existing measures, for example from ISO 27001 or BSI IT-Grundschutz, against Delegated Regulation (EU) 2024/1774.
2. Build classification into incident management: store the criteria and thresholds in your ticketing system or SIEM so your team can quickly decide whether an incident is major.
3. Prepare the reporting process: keep the templates from Implementing Regulation (EU) 2025/302 ready and assign responsibilities for the 4-hour deadline.
4. Maintain the register of information in a structured way: keep the register in a structured system rather than scattered spreadsheets.
5. Review contracts: check contracts with ICT service providers against Art. 30 DORA and the contractual policy under Delegated Regulation (EU) 2024/1773.

Our article How long does DORA implementation take? shows how much time to plan for this.

Conclusion: the technical standards make DORA workable

The so-called DORA EBA guidelines are mainly binding RTS and ITS. They set out what risk management, incident reporting, testing and third-party management must look like in practice. If you build the classification logic, reporting deadlines and register of information into your processes early, you can classify incidents faster and give supervisors robust evidence.

With heyData for fintech & finance, you implement DORA in a structured way: policies, the register of information and evidence are kept in one place.

Take the first step: Book a free demo now