What is DORA?
The DORA regulation (Digital Operational Resilience Act) is European Regulation 2022/2554 on digital operational resilience for the financial sector, applicable since 17 January 2025. It primarily concerns financial entities, as well as certain information and communication technology service providers that provide solutions to them.
Is Letsignit directly subject to DORA?
Letsignit is an ICT third-party service provider (SaaS) within the meaning of the DORA regulation. However, its services do not support critical or important functions as defined in Article 3 of the regulation, and Letsignit has not been designated as a critical ICT third-party provider (CTPP). Letsignit is therefore not subject to direct supervision by the European Supervisory Authorities under DORA.
Can a client request DORA compliance?
Yes. A financial client may ask Letsignit to provide contractual and operational assurances to help it meet its own DORA obligations.
These assurances may include, in particular:
a detailed description of the services provided;
availability and performance levels;
data security and confidentiality;
incident management and notification;
business continuity and disaster recovery;
data location;
the list of subcontractors;
the terms governing further subcontracting;
access, inspection, and audit rights;
termination conditions;
data return and reversibility;
assistance in the event of an incident or regulatory inspection.
Does Letsignit need to obtain DORA certification?
No. The DORA regulation does not provide for a general mandatory certification requirement for all SaaS providers.
#dora #digital operational resilience act