Practical DORA (Digital Operational Resilience Act) for SREs
summary
EU DORA takes effect Jan 2025 and covers financial entities and their critical third‑party providers; SREs must identify critical/important functions, run yearly production‑like resilience tests, and include providers in testing plans. An incident becomes a DORA major automatically on unauthorized network access or when criteria combine (service downtime >2 hours or incident >24 hours, cross‑EU impact, data loss/integrity issues, client/transaction volume, reputational harm, or economic impact > €100,000). Major incidents trigger an initial report (within 4 hours, max 24), an intermediate (72 hours) and a final report (1 month).
AI-written summary · about
chapters (10)
- 0:00DORA for SREs
- 1:22DORA for teams
- 2:23Digital resilience testing
- 5:14Third-party risk under DORA
- 7:18Incident management for DORA
- 10:49Major incident classification
- 15:43Automating incident classification
- 18:32DORA reporting timelines
- 21:19Final report and metrics
- 22:45Key takeaways
related talks
09mWhat is the DORA regulation?
13mDORA and Digitalisation – Friends or Foes? New Routes in Compliance
37mPanel | Finding DORA
22mDORA Metrics: The Key to DevOps Excellence
23mA Decade with DORA
22mSRE and Risk management: a love story
30mIntroducing DORA Core: Durable research insights for technical practitioners
23mOptimizing Delivery with DORA Metrics: How We Prepared and Where to Start