Written by the Nostra team · Reviewed October 2026
DORA is the EU regulation that makes financial entities responsible for their digital resilience the way they've long been responsible for financial soundness. For a credit union, that means proving — not asserting — that your systems can resist, respond to and recover from ICT disruption, whether that's ransomware, a supplier failure or a flood in the server room.
First, ICT risk management: a documented framework the board owns — what systems you depend on, what could go wrong, what controls exist. Second, incident management: classify ICT incidents and report major ones to the regulator on fixed timelines. Third, resilience testing: regularly test that recovery actually works, not just that backups ran. Fourth, third-party risk: every ICT supplier managed with contracts, due diligence and a register of information. Fifth, information sharing: arrangements for threat intelligence.
Your IT provider is a critical ICT third party under DORA, and the relationship has to look like it: contract clauses covering access, audit, exit and sub-outsourcing; entries in your register of information; due diligence at onboarding and annually; and evidence the provider's own resilience holds up. A provider serving credit unions should hand you this pack rather than make you chase it — at Nostra we maintain DORA-aligned contract terms, register entries and due diligence documentation as standard, alongside our partnership with Wellington IT.
Three moves cover the most ground quickly: build the register of information (every ICT supplier, what they do, how critical they are), fix the contracts with your most critical providers, and run one real recovery test with a written result the board sees. Regulators respond far better to honest progress with evidence than to polished policies nothing sits behind.
Written by the Nostra team | Reviewed October 2026
Yes — credit unions are in scope as financial entities. Proportionality applies to how you implement, not whether you comply.
The board. You can delegate work to your manager, risk officer and IT provider, but accountability for digital resilience sits with the management body.
A structured record of all your ICT third-party arrangements — who provides what, how critical it is, where data sits — that you must maintain and be able to produce for the Central Bank.
Thirty minutes with a Nostra specialist answers more than an afternoon of reading.
Book a 30-minute conversation