DORA in Estonia: short answer
DORA (Regulation (EU) 2022/2554) applies from 17 January 2025. It is directly applicable in Estonia. It covers banks, insurers, investment firms, payment and e-money institutions, crypto-asset service providers, fund managers and other listed financial entities, plus critical ICT third-party providers.
The practical core is an ICT risk framework, a complete register of information, contractual controls, incident reporting and resilience testing. The register is not a one-off spreadsheet: it must match contracts, functions, providers and subcontractors.
Who is in scope?
DORA covers a broad list of financial entities, including credit institutions, payment institutions, e-money institutions, investment firms, insurers and intermediaries, fund managers, central securities depositories, trading venues, crypto-asset service providers and crowdfunding service providers. Size exemptions do not apply in the same way as under NIS2.
ICT third-party providers are not automatically “DORA entities”, but critical providers can be designated and supervised at EU level. Financial entities remain responsible for their own outsourcing and concentration risk.
The register of information
The register records every contractual arrangement with an ICT third-party provider that supports a financial entity's services. A useful register answers:
- Which legal entity and branch uses the service?
- Which function and process does it support, and is it critical or important?
- Who is the provider, including ultimate parent and subcontractors?
- Where is data processed and stored?
- When does the contract start and end, and what is the exit plan?
Our DORA register validator (Estonian) checks a CSV or XLSX export for required fields and common gaps.
Contract clauses supervisors look for
- Service description, service levels and quantitative targets.
- Data location, protection, availability and return or deletion at exit.
- Access, audit and information rights for the financial entity and supervisors.
- Incident notification, cooperation and root-cause analysis.
- Business-continuity, backup and tested exit strategies.
- Subcontracting approval, change control and termination rights.
- Participation in TLPT where relevant.
A generic SaaS terms page is rarely enough for a critical function. The contract and the register must tell the same story.
Incident reporting and testing
DORA requires a documented ICT incident-management process, classification, reporting to the competent authority and communication to clients where relevant. Keep the timeline, affected services, root cause, recovery and lessons learned.
Resilience testing must match the entity's risk profile. TLPT is required for certain significant entities at least every three years and must follow the EU framework. A vulnerability scan is not TLPT.
TLPT and technical evidence
Threat-led penetration testing combines intelligence, red-team testing and controlled production impact. It tests critical functions and people, not only a web page. Evidence includes the scoping document, threat intelligence, test logs, findings, remediation and retesting.
Testing does not replace the register, contract review or continuity plan. It is one layer of the DORA evidence pack.
What a DORA evidence pack contains
- ICT risk assessment and approved risk appetite.
- Asset and service inventory mapped to business functions.
- Register of information with contract references.
- Continuity and recovery test results, including critical providers.
- Incident log, classification and reporting evidence.
- TLPT or other testing results and remediation tracking.
- Board and management oversight records.
Request a scoping call or start with the NIS2 guide if your entity also falls under KüTS.
Frequently asked questions
When did DORA start to apply?
DORA applies from 17 January 2025. It is an EU regulation and applies directly in Estonia.
What is the DORA register of information?
It is the structured inventory of contractual arrangements with ICT third-party service providers. It lets supervisors see concentration, critical dependencies and subcontracting chains.
Which contracts does DORA cover?
Contracts for ICT services, including cloud, software, data, security and managed services. Critical or important functions trigger additional contract and exit requirements.
Does DORA require penetration testing?
DORA requires threat-led penetration testing (TLPT) for certain significant entities, at least every three years. It is not a substitute for continuous vulnerability management.
Who supervises DORA in Estonia?
Finantsinspektsioon supervises financial entities in Estonia, within the European supervisory framework. ICT third-party providers are overseen through the designated ESA mechanism.