FAQ: We are ISO 27001 certified, are we DORA compliant?

Not so fast.

ISO 27001 and DORA both focus on cybersecurity and risk management, but they serve very different purposes. If you’re a financial institution or an ICT provider working with financial institutions in the EU, DORA compliance is mandatory, and ISO 27001 alone won’t get you there. Let’s break it down:

1. Regulatory vs. Voluntary Framework

↳ ISO 27001 – A voluntary international standard for information security management.

↳ DORA – A mandatory EU regulation for financial entities and their ICT providers, with strict oversight and penalties for non-compliance.

2. Scope and Focus

↳ ISO 27001 – Offers a customizable scope tailored to organizational needs, focusing on information security (confidentiality, integrity, availability) based on specific risk assessments and chosen controls.

↳ DORA – Enforces a standardized scope across financial entities, extending beyond security to operational resilience. It ensures institutions can withstand, respond to, and recover from ICT disruptions while maintaining service continuity.

3. Key Compliance Gaps

 Incident Reporting

↳ ISO 27001 – Requires incident management but doesn’t impose strict deadlines or mandate reporting to regulators, as it is a flexible standard.

↳ DORA – 4 hours to report a major incident, 72 hours for an update, 1 month for a root cause analysis.

 Security Testing

↳ ISO 27001 – Requires vulnerability management but leaves testing methods and frequency to organizational risk.

↳ DORA – Annual resilience testing, threat-led penetration testing every 3 years, continuous vulnerability scanning.

 Third-Party Risk Management:

↳ ISO 27001 – Covers supplier risk but with general security controls.

↳ DORA – Enforces contractual obligations, exit strategies, and regulatory audits for ICT providers working with financial institutions.

4. How financial institutions and ICT providers can address the delta?

 Perform a DORA Gap Analysis – Identify missing controls beyond ISO 27001. (Hopefully, you’re not still at this stage now that DORA has been mandatory since January 17, 2025.)

 Upgrade Incident Response – Implement real-time monitoring and reporting mechanisms to meet DORA’s deadlines.

 Enhance Security Testing – Introduce formalized resilience testing and threat-led penetration testing.

 Strengthen Third-Party Risk Management – Update contracts, prepare for regulatory audits, and ensure exit strategies comply with DORA.

 Improve Business Continuity Planning – Move from cybersecurity alone to full digital operational resilience.