DORA Exposes Gaps in Continuous Compliance Monitoring

The European Union’s Digital Operational Resilience Act, or DORA, became applicable on Jan. 17, 2025, requiring financial entities and critical information-technology providers to produce ongoing evidence of operational risk management. The challenge is broader than checking whether individual controls are functioning: asset inventories, risk registers and third-party dependencies must also remain accurate as systems and exposures change.

A recent analysis says firms are quietly falling short by treating continuous compliance as synonymous with control monitoring. Dashboards may show healthy controls even when the underlying assets and recorded risks have shifted. To meet DORA and NIS2 expectations, companies need a six-layer compliance structure spanning asset inventories, risk assessments, controls, evidence collection, third-party management and continuous validation.