Briefing
DORA guide for US organizations
This guide is for security and risk leaders at US financial institutions with EU operations or EU financial clients. It shows how DORA reaches US firms, where your domestic compliance program stops covering you, and how to find the gap before an EU supervisor does.
The three triggers that bring US firms into DORA scope
Five gaps that documentation doesn’t close
What NYDFS Part 500, SEC rules and NIST CSF don’t cover
What EU enforcement looks like in 2026
Free download
Nobody told you DORA was your problem. It is.
Your domestic compliance program is solid: NYDFS Part 500 covered, FFIEC examined, SEC disclosure obligations understood. But if your firm operates an EU-licensed entity, serves EU financial clients or runs US-managed infrastructure for EU operations, you’re subject to the Digital Operational Resilience Act.
DORA has applied since January 17, 2025, and EU supervisors are now running formal assessments. Your domestic program answers the right questions for a US regulator. An EU supervisor is asking different ones.
This guide maps how DORA reaches US firms, where domestic compliance stops covering you, and how to close the gap before a supervisor finds it.
Your EU footprint is your DORA exposure.
DORA reaches US firms through three routes: an EU-licensed entity, contracts with EU financial clients, and intra-group ICT arrangements that support EU operations.
The last is the one most often missed. If your EU subsidiary relies on your US SOC, cloud team or shared services, each arrangement needs to be documented and contracted to Article 30 standards, even though the counterparty is your own group.
A pen test isn’t resilience testing.
Your annual penetration test was scoped months in advance and run against a subset of infrastructure. Article 24 requires independent testing of the ICT systems that support your EU entity’s critical or important functions.
Testing the way an attacker would, without warning and against real infrastructure, shows whether your controls hold and whether your defenders would even notice.
Enforcement is already here.
The ECB integrated DORA into its supervisory review in January 2026, and national authorities across the EU are running formal assessments. Firms are receiving supervisory letters, and periodic penalty payments are being issued.
For US firms, the risk arrives two ways: directly through your EU-licensed entities, and indirectly through EU clients who will replace suppliers that can’t meet Article 30.
Stop testing.
Start knowing.
You’ll know exactly where you stand, and you’ll be able to prove it. To your board, your regulator, and yourself.
Transform to a proactive, constant offensive security program
Your budget is aimed at the risk that matters, not the one you were handed
You show the board what security prevented, not a request for more
Security clears the way for the business to move faster
You enter the boardroom in command
It starts with a 30-minute Attack Discovery call.
No access to your systems required.