DORA

The Digital Operational Resilience Act has been binding in the EU since January 2025. It obliges financial companies to tightly manage their IT risks, their incident management and, above all, their third-party IT providers. For critical ICT providers, DORA can mean direct oversight. In practice this means: financial customers pass strict requirements on to their IT providers, for example on security, resilience, reporting obligations and contract terms.

For IT providers with financial customers, DORA above all means one thing: more and stricter questions. Customers demand detailed evidence on resilience, subcontractors and security measures, often in extensive questionnaires and with clear deadlines. Whoever answers these requirements confidently becomes a preferred partner in the regulated space; whoever struggles loses access to a lucrative market. The requirements are very similar across customers, yet are rarely reused.

With Tendry you answer your financial customers' DORA-related requirements quickly and with evidence from a verified knowledge base. How the buyer side manages DORA in outsourcing management is shown by our platform Leno.