DORA for Greek Financial Institutions and Their ICT Providers

The Digital Operational Resilience Act (DORA) is an EU regulation that has applied since 17 January 2025. Unlike a directive, a regulation applies directly in every member state, including Greece. It sets common rules for how financial entities manage ICT risk and how they work with the technology providers they depend on.

Who is covered?

DORA covers a wide range of financial entities: credit institutions, payment and e-money institutions, investment firms, insurance and reinsurance undertakings and intermediaries, asset managers, crypto-asset service providers, central securities depositories, trading venues and more. It also reaches ICT third-party service providers, and gives EU supervisors direct oversight of those designated as critical. Smaller providers are affected through the contractual requirements that their financial customers must now impose.

The five areas of DORA

1. ICT risk management. A documented framework, with the management body responsible for it.
2. Incident management and reporting. Classify incidents and report major ones to the competent authority using prescribed timelines and templates.
3. Digital operational resilience testing. Regular testing, including advanced threat-led penetration testing for the most significant entities.
4. Third-party risk management. A register of ICT contracts, due diligence, mandatory contract clauses and exit strategies.
5. Information sharing on cyber threats between financial entities.

What this means if you are an ICT provider

If you host, manage or secure systems for a Greek bank or insurer, expect new questions and new contract terms: audit and access rights, incident notification duties, subcontractor transparency, security standards, and exit and portability plans. Providers that can answer these questions with evidence will be easier to buy from.

A practical readiness checklist

• Do you have a current ICT risk framework approved by management?
• Can you classify and report an incident within the DORA timelines?
• Do you hold a register of all ICT third-party arrangements, with the critical ones identified?
• Do your contracts include the clauses DORA requires?
• Do you test your recovery and resilience, and keep the results?
• Have you tested a realistic exit from a critical provider?

Which Greek authority?

Supervision depends on the type of entity, for example banks, insurers, capital markets firms and payment institutions each have their own competent authority. Confirm yours before you build your reporting process.

How Guardbyte can help

We help financial entities and ICT providers assess where they stand, close gaps in monitoring, backup, access control and incident readiness, and gather the evidence DORA expects. See our NIS2 and DORA compliance page, our managed SOC and our advisory services, or book a meeting.

This article is general information and not legal advice. Confirm your obligations with your legal adviser and your supervisor.