From Compliance to Capability: DORA Enters the Operationalisation Phase

KPMG’s 2026 benchmarking exercise shows that financial institutions have built much of the governance required by the Digital Operational Resilience Act. The next challenge is harder: proving that resilience works consistently in day-to-day operations and under stress.

The survey, conducted in February and March 2026, gathered responses from more than 70 financial institutions across 17 countries and four peer groups. Its central message is that DORA maturity is uneven. Formal roles, policies and governance artefacts are largely in place, but operational evidence often trails design. Institutions are therefore moving from a compliance programme mindset towards a sustained business-as-usual capability.

ICT risk management is the most structurally advanced domain. Sixty-six per cent of respondents assign DORA accountability to a single named executive. Among those institutions, 88% have established a formalised ICT risk management control function. Yet strong ownership does not automatically produce strong measurement. While 70% report digital resilience to the board monthly or quarterly, only 32% have fully defined and implemented DORA-specific KPIs and KRIs. Reporting cadence is progressing faster than the underlying evidence framework.

Source: KPMG DORA Implementation Survey, 2026 Benchmarking Exercise

Figure 1. Selected benchmark indicators across the four DORA pillars

The results of the survey, although they cover a wider geographical area, are closely aligned with the local situation, notes Gabriel Mihai Tanase, Partner in the KPMG Cyber function in Romania. The biggest challenge that the Romanian organizations applying DORA have, are also linked to risks related to third party service providers, translated both at contract level (insufficient security and resilience provisions), and later on, monitoring the fulfillment of those provisions, he concludes.

The benchmark also highlights the importance of methodology. Forty per cent of institutions use a DORA-based method to identify critical or important functions, and this approach tends to produce a broader scope. Likewise, the method used to derive supporting ICT assets materially changes the resulting critical-asset perimeter. The lesson is practical: implementation outcomes depend not only on investment, but on the definitions, thresholds and mapping logic adopted.

Incident management presents a similar pattern. Fifty-six per cent enhanced an existing SIEM rather than replacing it, suggesting that technology foundations were often already available. However, respondents still report difficulties with timely data collection, DORA threshold alignment and escalation workflows. Tooling alone cannot resolve inconsistent classification logic or weak reporting-data quality.

Third-party risk management faces the greatest redesign pressure. Fifty-one per cent have renegotiated more than three-quarters of contracts supporting critical or important functions. Nevertheless, long negotiation timelines and provider resistance to DORA clauses remain widespread, while 73% manage non-compliant providers case by case. Exit planning also outpaces validation: 63% have documented or are developing exit strategies for all providers supporting the critical and important functions (CIF), but 66% lack either a structured testing methodology or testing activity.

Source: KPMG DORA Implementation Survey, 2026 Benchmarking Exercise

Figure 2. Contract-renegotiation challenges and handling of non-compliant providers

Testing and audit are becoming recurring disciplines, although testing intensity remains conservative. Sixty-three per cent place DORA within annual or multi-year internal audit cycles, while annual CIF-focused testing is the most common calendar pattern. For institutions officially designated for threat-led penetration testing, 85% report at least annual CIF-focused testing, showing how concrete regulatory expectations can strengthen execution discipline.

Indeed, DORA enters a new phase of operationalization. While the first steps were taken (i.e. aligning to the technical requirements), now we can see that the financial institutions applying DORA switched their focus on testing their resilience and auditing the effective operation of the security and resilience controls, observes Gheorghe Vlad, Director in the KPMG Cyber function in Romania. From this point of view, Romania was in the first wave of the countries that performed advanced, threat lead penetration testing in accordance to DORA requirements, thus addressing the state of play when it comes to the resilience of the financial sector, Gheorghe concludes.

The report’s conclusion is clear. The next phase of DORA is not another governance redesign. It is the industrialisation of resilience: consistent metrics, repeatable controls, tested exit arrangements and evidence that operational safeguards perform when they are needed most.

Source: KPMG, DORA Implementation Survey, 2026 Benchmarking Exercise, June 2026.