The Digital Operational Resilience Act (DORA) is a European Union regulation that strengthens the digital resilience of financial entities. It establishes uniform requirements so that firms in the financial sector can withstand, respond to, and recover from Information and Communication Technology (ICT) disruptions and threats.

DORA came into effect in January 2023 and became fully applicable on January 17, 2025.

When DORA Is Relevant

Evaluate DORA if your organization is a financial entity within its scope, such as a bank, payment institution, investment firm, or insurer, or provides ICT services to one. The regulation identifies covered entities and exceptions in Article 2. Handling financial records alone does not determine your organization's status.

For a financial entity using Files.com, identify the functions the service supports and whether any are critical or important. That assessment informs ICT supplier review, contractual requirements, continuity planning, and oversight of the arrangement.

DORA distinguishes financial entities' obligations, requirements for ICT service arrangements, and the oversight framework for ICT third-party providers designated as critical. Identify the duties and contractual conditions relevant to your role in the arrangement.

Files.com and DORA

Files.com supports customers' DORA obligations through operational and security controls, independent assurance, and a DORA Addendum available to qualified customers. The addendum and your own ICT risk-management duties need to be evaluated together; the availability of these controls does not establish compliance for every customer arrangement.

Files.com supports customers in meeting their DORA obligations through the following capabilities:

Secure infrastructure, including encryption in transit and at rest, detailed audit logs, access controls, and regional storage options.
Business continuity and incident response, supported by redundant systems, high-availability architecture, and documented incident management processes.
Operational and security monitoring, including real-time monitoring, automated alerting, and SIEM integration support.
Independent security validation through an annual SOC 2 Type II audit conducted by an independent third-party firm, validating the effectiveness of our security, availability, and confidentiality controls.
A DORA Addendum available to qualified customers upon request.

Shared Responsibility

DORA compliance using Files.com operates under a Shared Responsibility Model. Files.com is responsible for the infrastructure, platform, and security controls we provide. You are responsible for configuring your usage, conducting your own resilience testing, managing risk assessments, and fulfilling regulatory reporting duties.

DORA compliance is achievable only if your environment is configured correctly. We provide the platform, security features, and operational tools. You implement and use them in a manner consistent with DORA and other applicable regulatory requirements.

This article is not legal advice. Organizations subject to DORA are solely responsible for confirming that their use of Files.com complies with all provisions of the regulation, including ICT risk management, incident handling, and third-party oversight. Work with your legal and compliance teams to determine your specific obligations under DORA and to validate that your implementation of Files.com supports your operational resilience goals.