Deloitte Survey Finds Gaps in Financial Firms’ DORA Readiness
Summary
A 2025 Deloitte survey of 36 financial entities across 28 countries found challenges with DORA documentation and ICT system segmentation. Only 8% felt fully compliant with resilience testing and ICT third-party risk requirements.
Key points
- The 2025 survey covered 36 financial entities in 28 countries, primarily engaging CISOs, CROs, and DORA programme managers.
- Completing the DORA Register of Information was the leading challenge, cited by 46% of respondents; 42% cited ICT system segregation and segmentation.
- Around 64% expected to spend €2–5 million on DORA, with an average of 5–8 full-time-equivalent staff involved.
- Although 48% reported full compliance with DORA incident management requirements, only 8% felt fully compliant with resilience testing and ICT third-party risk management.
- Half of respondents conducted weekly automated testing on systems supporting Critical or Important Functions; 70% conducted annual penetration testing.
- The article describes Wiz as a tool for cloud and on-premises compliance monitoring and audit evidence, while noting that governance, policies, and processes also require non-technical work.
Article Details
- Publisher
- Wiz IO
- Report Period
- 2025 survey
- Scope
- DORA compliance readiness and implementation challenges among financial entities
- Sample Size
- 36 entities across 28 countries
- Key Statistics
- Around 64% of respondents expected to spend EUR 2–5 million on their DORA program; the reported average involvement was 5–8 FTEs.
- 46% identified completing the DORA Register of Information as a major challenge; 42% cited segregation and segmentation of ICT systems.
- 64% identified 20–30 Critical or Important Functions.
- 50% reported weekly automated testing on systems supporting Critical or Important Functions; 70% conducted annual penetration testing.
- 48% reported full compliance with DORA Incident Management requirements, compared with 8% for Digital Operational Resilience Testing and ICT Third-Party Risk Management.
- Recommendations
- Perform a yearly internal audit of the ICT risk management framework.
- Establish processes to promptly report major ICT-related incidents to national authorities.
- Assess and manage risks associated with third-party ICT providers.
- Conduct regular digital resilience testing, including penetration tests.