Digital Operational Resilience Act (DORA) 

**Executive summary:** This document provides an overview of the EU Digital Operational Resilience Act (DORA), its scope and applicability to financial entities and ICT suppliers, the five pillars of digital operational resilience, incident reporting timelines (initial notification within 4 hours of classification as major / no later than 24 hours after detection, intermediate report within 72 hours, final report within 1 month), testing and third-party risk requirements, and how DORA relates to ISO 27001 and enforcement by member states.