What Is the Digital Operational Resilience Act (DORA)?

## Executive summary This briefing explains the EU Digital Operational Resilience Act (DORA), its purpose, scope, five core pillars (ICT risk management; ICT-related incident reporting; digital operational resilience testing; third-party ICT risk management; and information sharing), and its implementation timeline toward January 17, 2025. It frames DORA in the context of heightened ransomware activity in 2023—naming LockBit, ALPHV/BlackCat, and Cl0p—and highlights the MOVEit supply-chain incident (CVE-2023-34362) as an example of systemic ICT risk that DORA seeks to mitigate.