Large banks and insurers usually run DORA on an enterprise risk platform they already own: ServiceNow IRM if IT operations, incidents and assets already live in ServiceNow, Archer or MetricStream if the operational risk function runs on them. OneTrust is a strong choice for the third-party side, including the register of information and contract reviews. Mid-size payment institutions, crypto firms and investment firms can use Hyperproof to map DORA controls alongside ISO 27001 and other frameworks. Software companies selling to EU financial firms can document DORA-aligned controls in Vanta. DORA has applied since January 17, 2025, and the ESAs designated 19 critical ICT providers, including AWS, Google Cloud and Microsoft, in November 2025.
Best for ICT providers selling to EU financial firms
From $14K/yr
4.6/5 (G2)
1. Best if IT operations already run on ServiceNow
ServiceNow IRM
Connects enterprise risk, compliance, audit, and operational resilience workflows for organizations using the ServiceNow platform.
DORA is as much an IT operations regulation as a risk one. It asks for an inventory of ICT assets and their dependencies, incident classification and reporting, change management and business continuity. ServiceNow IRM sits on the same platform as ServiceNow's IT service management, configuration management database and security operations, so an ICT incident can be classified against DORA criteria from the record your operations team already opened. IRM comes in Standard, Professional and Enterprise editions, with regulatory change and advanced risk features in the higher tiers. Pricing is negotiated and implementation usually needs ServiceNow specialists.
Pricing: ServiceNow does not publish a paid entry price for IRM. Pricing is negotiated and can depend on edition, employee or user scope, selected applications, contract terms, and implementation. Standard, Professional, and Enterprise are the documented package levels, with Professional and Enterprise adding progressively more advanced risk, regulatory, and audit capabilities.
Connects risk and compliance records with ServiceNow services, assets, workflows, and ownership data.
Covers policy, risk, compliance cases, regulatory change, continuous monitoring, and audit in one platform.
Archer is used by 38 of the 50 largest global banks and covers operational risk, business resilience, third-party governance and regulatory change, with content from more than 8,000 regulatory sources. For DORA, that means the ICT risk framework, third-party register, resilience testing records and incident data can be connected to the bank's wider risk taxonomy. It runs as SaaS or on premises. Expect a significant implementation, and note its 3.6 G2 rating from 20 reviews.
Pricing: Archer sells quote-based subscriptions rather than a public self-serve plan. Its AWS Marketplace listing uses contract-based purchasing and directs buyers to request a private offer.
Combines audit, compliance, risk, resilience and third-party governance on one data model.
Cross-framework control mapping reduces duplicate testing and evidence collection.
Supports both SaaS and private or on-premises deployment for demanding data requirements.
Pricing is quote-based, with no public software rate card or free trial.
The breadth and configurability can require substantial implementation and administration effort.
G2 reviewers give Archer 3.6 out of 5 from 20 reviews, below several major GRC rivals.
MetricStream serves more than 1 million users and covers operational risk, IT and cyber risk, third-party risk, compliance and audit, mainly for large financial institutions. Its value for DORA is in linking ICT risk assessments, controls and testing to group-level operational risk and audit, across many legal entities. It suits groups with operations in several EU countries that report to more than one supervisor. Pricing is quoted.
Pricing: MetricStream publishes no standard plan prices and asks prospects to request pricing. The commercial scope is negotiated around the selected GRC applications and enterprise requirements. Public pricing and free-plan benchmarks are not available.
Covers risk, compliance, audit, cyber, third-party and resilience use cases in one connected data model.
Continuous control monitoring can automate evidence collection and broaden control coverage.
AppStudio and OpenAPI-compliant APIs provide configuration and integration options.
Implementation and configuration can be demanding for teams without dedicated GRC administration.
The breadth of modules may be excessive for smaller companies seeking a narrow compliance tool.
No public pricing makes budgeting and plan comparison difficult before a sales process.
4. Best for ICT third-party risk and the register of information
OneTrust
Govern privacy, data use, AI, technology risk, and third-party compliance for enterprises across global regulations and frameworks.
OneTrust was named a Leader in Gartner's first Magic Quadrant for third-party risk management tools in April 2026. For DORA, its third-party management product can hold the ICT services inventory, risk-tier providers that support critical or important functions, track contractual provisions and feed the register of information. It also covers privacy and AI governance, useful when the same vendor appears in GDPR and DORA reviews. Pricing is quote-based and metered on third-party inventory size.
Pricing: OneTrust sells solution packages with usage-based meters rather than publishing standard prices. Pricing can depend on administrator users, asset or third-party inventory, data-subject profiles, average daily visitors, or annual scan volume. The company says customers can expand usage during the contract term, with higher tiers or contract amendments applying when licensed limits are exceeded.
Covers privacy, consent, AI, GRC, technology risk, and third-party management in one platform.
Supports usage-specific pricing across administrators, inventories, profiles, visitors, and scan volume.
Offers broad connectivity through APIs, SDKs, data feeds, system integrations, and 500-plus pre-built plug-ins.
Quote-based, usage-metered pricing makes costs difficult to estimate before a sales process.
The platform’s breadth can require significant configuration, implementation, and internal program ownership.
Different solutions use different pricing meters, which can complicate procurement and budgeting.
Payment institutions, e-money firms, crypto-asset service providers and smaller investment firms fall under DORA but rarely have the budget for Archer or ServiceNow. Hyperproof supports DORA alongside ISO 27001, NIST CSF, NIS2 and more than 160 other frameworks, so controls you already maintain for ISO 27001 can be mapped to DORA requirements once. It includes risk registers and third-party risk modules. Vendr reports a median annual contract of $41,400.
Pricing: Hyperproof does not publish standard list pricing. Vendr reports a median annual contract value of $41,400 from 44 purchases, with average savings of 21.15%; this is a market benchmark, not an entry plan. The free TPRM trial is available without implementation, while paid TPRM Core and Advanced plans require a sales conversation.
Common-control mapping can reduce duplicated work across large framework portfolios.
More than 200 Hypersync connectors support automated evidence collection from existing tools.
The platform combines compliance, risk, audit, trust, governance, and third-party risk modules.
Standard subscription pricing is not publicly listed, complicating initial budget planning.
Complex deployments may require separately quoted implementation, configuration, and professional services.
The broad module set can require substantial administration and program design.
Many companies affected by DORA are not financial entities but software vendors whose customers are. Banks now push DORA contract terms, audit rights, incident notification and exit requirements down to their suppliers. Vanta supports DORA and NIS2 alongside SOC 2 and ISO 27001, with more than 400 integrations, so a SaaS company can show which DORA-relevant controls it operates and share them through its trust center. G2 lists 2,664 reviews averaging 4.6.
Pricing: Vanta doesn't publish prices on its website. AWS Marketplace lists scoped starting prices for companies with 1–20 employees, and Vendr reports a median contract of $20,000/year across 374 purchases (range roughly $7,500–$57,000). Typical single-framework budgets are $12K–$25K/yr for 1–50 employees, $20K–$40K for 51–200 and $35K–$60K for 200–500. Budget separately for the audit fee and any remediation work.
Automated evidence collection replaces most manual screenshots
Clean interface and fast onboarding, frequently praised in 2026 reviews
Very broad integration and framework coverage
Expensive for very small teams, with median contracts around $20K/yr
Integration gaps for less common or complex stacks
Some controls still need manual work and setup time
The Digital Operational Resilience Act replaced a patchwork of national rules and EBA guidelines with one regulation for how financial firms in the EU manage technology risk. It has applied since January 17, 2025 and is built on five pillars:
ICT risk management. A documented framework approved by the management body, covering identification of ICT assets and dependencies, protection, detection, response, recovery, backup, learning and communication.
ICT incident management and reporting. Classify incidents against criteria set in technical standards, and report major incidents to the competent authority on tight deadlines.
Digital operational resilience testing. A testing program including vulnerability scans, scenario tests and, for larger firms, threat-led penetration testing every three years.
ICT third-party risk. A strategy and policy for ICT providers, a register of information on all ICT contracts, mandatory contract terms and exit plans.
Information sharing. Voluntary arrangements to share threat intelligence among financial entities.
The management body is personally accountable for the ICT risk framework, which is one reason boards now ask for DORA reporting.
What changed in 2025 and 2026
The first year of DORA was dominated by the register of information. Financial entities submitted their first registers to national authorities in 2025, and many found it harder than expected: the register needs legal entity identifiers, contract data, the functions each service supports and the chain of subcontractors.
The ESAs then used those registers to designate critical ICT third-party providers. On November 18, 2025 they named 19, including Amazon Web Services, Google Cloud, Microsoft, Oracle, SAP, IBM, Accenture and Bloomberg. These providers are now overseen directly by a lead overseer at EU level. For financial entities, designation does not reduce their own obligations; they still have to manage the risk of each provider.
As supervision moves past first submissions, expect questions about data quality in the register, incident classification decisions, and whether exit plans for critical providers are realistic.
How we chose these six
We reviewed the GRC, risk and compliance platforms in our compliance directory and audit directory that support DORA. We weighted coverage of the five pillars, especially the register of information and incident reporting, fit with existing IT and risk systems at financial firms, suitability for different sizes of entity, and published pricing benchmarks. Pricing is as of October 2026.
Specialist DORA and register tools outside our directory include 3rdRisk (now part of Diligent) and several register-of-information services from consulting firms. Many banks also extend their existing ServiceNow or Archer implementations rather than buying new software.
Which tool fits which entity
Entity
Typical choice
Why
Large bank or insurer on ServiceNow
ServiceNow IRM
Incidents, assets and changes already in ServiceNow
Large bank with an established GRC suite
Archer or MetricStream
Connects DORA to operational risk and audit
Firm whose biggest gap is third-party oversight
OneTrust
Register, tiering, contracts and monitoring
Payment, e-money, crypto or smaller investment firm
Hyperproof
DORA mapped with ISO 27001 and NIS2
SaaS or ICT provider with financial customers
Vanta
Show DORA-aligned controls to customers
Incident reporting under DORA
Incident reporting is where DORA is most operational, and where tools save the most time. Financial entities must classify ICT-related incidents using criteria such as clients affected, duration, geographic spread, data losses, criticality of services and economic impact. For a major incident:
Initial notification: within 4 hours of classifying the incident as major, and no later than 24 hours after becoming aware of it.
Intermediate report: within 72 hours of the initial notification.
Final report: within one month of the latest intermediate report.
The classification has to be made quickly, documented and consistent. Tools that hold the classification criteria, start clocks automatically and generate reports in the regulator's format reduce the risk of missing a deadline at 2 a.m. Significant cyber threats can also be reported voluntarily.
The register of information in practice
The register is a set of linked tables covering the financial entity, its ICT providers, each contractual arrangement, the functions supported and the supply chain behind each provider. Common problems:
Incomplete inventories. Contracts held by business units, procurement and IT in different systems.
Missing identifiers. Legal entity identifiers or European unique identifiers for providers and their parents.
Function mapping. Deciding which business functions are critical or important, and which ICT services support them.
Subcontractor chains. Getting providers to disclose material subcontractors.
Software helps by keeping the register live instead of rebuilding it once a year, validating data before submission and connecting it to vendor assessments.
Advice for ICT providers selling to financial firms
If you sell software or services to EU banks, insurers or payment firms, DORA reaches you through contracts. Expect requests for:
Service descriptions, locations of data processing and subcontractor lists.
Incident notification commitments with defined timelines.
Audit and access rights for the customer and its supervisor.
Participation in the customer's resilience testing.
Exit and transition assistance.
A well-maintained trust center and a mapped control set make these conversations shorter. See our trust center guide and our SOC 2 cost guide. For third-party risk tools more broadly, see our TPRM guide.
Frequently asked questions
What is DORA?
The Digital Operational Resilience Act, Regulation (EU) 2022/2554, sets uniform rules for how EU financial entities manage ICT risk. It covers ICT risk management, incident reporting, digital operational resilience testing, third-party risk and information sharing. It has applied since January 17, 2025.
Who does DORA apply to?
About 20 types of financial entities, including banks, insurers, investment firms, payment and e-money institutions, crypto-asset service providers, fund managers, trading venues and crowdfunding platforms. ICT providers designated as critical are supervised directly. Other ICT providers are affected through contract terms their financial customers must impose.
What is the DORA register of information?
A register that financial entities must keep of all contractual arrangements for ICT services, with more detail for services supporting critical or important functions. National competent authorities collect it, and the ESAs used the 2025 registers to designate critical ICT third-party providers.
Which providers are critical ICT third-party providers under DORA?
On November 18, 2025 the ESAs designated 19 providers, including Accenture, Amazon Web Services, Bloomberg, Capgemini, Deutsche Telekom, Equinix, FIS, Google Cloud, IBM, Kyndryl, LSEG, Microsoft, NTT Data, Oracle, Orange, SAP and Tata Consultancy Services. They are now subject to direct EU oversight.
What are the DORA incident reporting deadlines?
For a major ICT-related incident, the initial notification is due within 4 hours of classifying it as major and no later than 24 hours after becoming aware of it. An intermediate report follows within 72 hours of the initial notification, and a final report within one month of the latest intermediate report.
Do I need special software for DORA?
No regulation requires a particular tool. Small entities can meet DORA with a GRC tool or well-controlled spreadsheets. Software helps most with the register of information, incident classification and timelines, mapping controls across DORA, NIS2 and ISO 27001, and evidence for supervisors.
Prices and ratings come from each vendor's public pricing pages and review sites as of October 22, 2026. Vendors change pricing often, so confirm with a quote. Nothing here is tax or legal advice.
