How DORA Applies to Insurance
DORA Article 2 brings several categories of insurance-sector entities into scope:
- •Insurance undertakings authorised under Solvency II — life, non-life, and composite insurers
- •Reinsurance undertakings — including pure reinsurance operations
- •Insurance and reinsurance intermediaries meeting specified size thresholds — larger brokers fall in scope, the smallest may be exempt
- •IORPs — Institutions for Occupational Retirement Provision above defined thresholds
Proportionality applies throughout. Large life insurers with complex ICT estates face the full framework; smaller intermediaries operate under a lighter regime. The regulatory assessment of scope and depth is made by reference to size, complexity, and risk profile against criteria in DORA itself.
Insurance-Specific DORA Requirements
The DORA framework applies to insurers with specific emphasis on the ICT systems and third-party arrangements that support core insurance operations:
ICT Risk Management for Insurance Operations
Policy administration systems, claims processing platforms, and actuarial modelling environments are typically designated as supporting critical or important functions. ICT risk management must cover governance, protection, detection, and recovery for these systems — integrated with existing Solvency II Pillar 2 governance.
Incident Reporting for Insurance-Specific Systems
Major ICT-related incidents must be reported to national competent authorities within DORA's defined timeframes. For insurers, this includes incidents affecting policyholder services, claims processing, and core administration platforms. EIOPA coordinates supervisory consistency across member states.
Resilience Testing for Insurance Platforms
All insurers must conduct basic resilience testing. Significant insurers must additionally undertake threat-led penetration testing (TLPT) every three years for systems supporting critical or important functions. Testing must cover scenarios specific to insurance operations, not just generic cyber scenarios.
Third-Party Risk for Outsourced Functions
Insurance is heavily outsourced: actuarial modelling, claims administration, policy administration platforms, cloud infrastructure. DORA requires comprehensive due diligence, specific contractual provisions, and ongoing monitoring. Insurers must maintain the register of information covering all ICT third-party arrangements.
DORA and Solvency II
The most significant integration challenge for insurers is mapping DORA into Solvency II's existing governance framework. Solvency II Pillar 2 already covers governance, risk management, internal control, and the Own Risk and Solvency Assessment (ORSA). DORA adds more specific ICT requirements on top.
Rather than running DORA as a separate compliance track, insurers should integrate it into the Solvency II governance structures that already exist:
- •Governance— DORA's ICT risk framework should feed into the overall Solvency II governance system approved by the administrative, management, or supervisory body
- •ORSA— ICT risk should be addressed in the Own Risk and Solvency Assessment; DORA's incident data and testing results become inputs to ORSA analysis
- •Operational risk — DORA incident data feeds into operational risk calculations under Solvency II Pillar 1, where applicable to the standard formula or internal model
- •Outsourcing — DORA's ICT third-party framework aligns with and extends Solvency II outsourcing requirements; the register of information complements existing outsourcing registers
- •Supervisory reporting — DORA major incident reports integrate with existing Solvency II reporting and EIOPA supervisory engagement
EIOPA's role in coordinating DORA supervision across member states reinforces this integrated view. Insurers that build a separate DORA compliance programme end up duplicating work already done under Solvency II. The better approach is to extend existing governance and documentation to cover DORA's specific ICT requirements.
DORA Document Requirements for Insurers
Insurers must maintain a documentation set that satisfies both DORA and the integration points with Solvency II:
- •ICT governance policies integrated with the Solvency II system of governance
- •Operational resilience plans and business continuity documentation
- •Outsourcing register extended to become the DORA register of information covering all ICT third-party arrangements
- •Incident response documentation including classification thresholds and notification procedures
- •Testing programme documentation including TLPT results for significant insurers
- •Contract templates with DORA-mandated provisions for all ICT service arrangements
How ComplyLoft Auditor Helps Insurers
The ComplyLoft Auditor can be configured with DORA requirements and run across an insurer's existing ICT governance and Solvency II documentation. It cross-references the two frameworks to identify genuine gaps rather than forcing parallel compliance streams.
- •Automated document auditing against DORA requirements with Solvency II cross-referencing
- •Gap analysis highlighting where existing Solvency II documentation needs DORA-specific extensions
- •ICT third-party contract review against DORA-mandated provisions
- •Register of information completeness checks across insurance ICT arrangements
- •Ongoing monitoring support for evolving DORA and Solvency II requirements
ComplyLoft Auditor identifies potential compliance gaps and provides a structured starting point for review. All outputs require human review and sign-off. ComplyLoft does not guarantee compliance.