This blog article provides a brief overview of the DORA regulation, outlines how Okta can support compliance adherence, and introduces our new Factsheet, a helpful resource for satisfying DORA's regulated requirements.

What is DORA?

The Digital Operational Resilience Act (Regulation (EU) 2022/2554), most commonly known as DORA, became applicable in January 2025 and addresses a critical gap in EU financial regulation.

With the introduction of DORA, financial institutions must follow stringent guidelines for safeguarding against ICT-related incidents. These include measures for protection, detection, containment, recovery, and repair. DORA explicitly targets ICT risks, introducing clear rules for ICT risk management, incident reporting, operational resilience testing, and oversight of ICT third-party risks.

How does Okta support regulated customers?

Okta is committed to supporting our regulated customers in adhering to DORA regulatory compliance. To guide our customers in adhering to DORA requirements with Okta, we’ve recently released a helpful resource: the new DORA Compliance with Okta Factsheet.

This factsheet provides valuable information that regulated customers can reference in their compliance efforts, including:

• An Introduction to the Key DORA Domains

This section provides an overview of the five key DORA domains and a high-level view of how Okta’s controls, processes, and supporting documentation can help regulated customers achieve domain requirements. Customers can reference this to review Okta’s compliance information in alignment with the DORA requirements.

• How can Okta help?

This section highlights some of the many Okta features that are critical components of a highly available, resilient and secure identity platform. Customers can reference the information and links within this section to perform a thorough assessment of Okta’s security posture as it applies to their own DORA regulatory requirements. 

• Detailed DORA Article mapping 

Lastly, this section proactively maps the DORA domains and applicable DORA Articles with corresponding Okta Control Library Supporting Information for easy reference. Okta’s Control Library supports customers with a comprehensive collection of security controls adopted by our organization to protect systems and data.

More on Compliance

As highlighted in our DORA Compliance with Okta Factsheet, Okta upholds a strong compliance framework to demonstrate our commitment to maintaining highly available, secure and resilient products and services - many of the DORA requirements are business as usual.

A key component of our methodical customer support is making the information they require readily available. We publish our latest independent audit reports and other related documents on the Security Trust Center. For more information on accessing Okta's Security Trust Center, visit our Okta Docs.

The Security Trust Center and all available documentation is accessible to customers and prospects of Okta. Site visitors can view Okta’s certifications and access industry-standard questionnaires. To learn more about our efforts, read our blog article, Empowering Security with Customer Trust Solutions.  Keep watching as we publish additional helpful resources; more to come.

Disclaimer: While this article discusses certain legal concepts, it does not constitute legal advice. It is provided for informational purposes only. For legal advice regarding your organization's compliance needs, please consult your organization's legal department. Okta makes no representations, warranties, or other assurances regarding the content of this article. Information regarding Okta's contractual assurances to its customers can be found at okta.com/agreements.

Aimi Mcilwraith is a Senior Security Analyst at Okta. The Customer Assurance team within Security Trust & Culture supports Okta’s growing customer base with inquiries pertaining to security and compliance. Backed by over a decade of Security experience working in public and private sector organizations, Aimi has honed a deep understanding of security practices and risk management. CCSK and NIST CSF-certified, she leverages her knowledge and commitment to excellence in safeguarding digital environments to support customers globally from the EMEA region. In her downtime, Aimi enjoys reading and attending concerts.