Vanta’s story began like many other startups—moving fast to discover product-market fit and lay the groundwork for a sustainable business. Speed was key as we focused on delivering value to customers and rapidly iterating to meet market needs. This approach propelled us into a phase of healthy growth, marked by milestones we proudly celebrate (read more about our recent achievements here).

Today's buyers are doing their homework—they want to know they can trust your business before they commit. According to Vanta’s latest State of Trust report, nearly 65% of companies say their customers, investors, and suppliers increasingly require proof of compliance before making a purchase. ‍

The Digital Operational Resilience Act (DORA) has been developed to protect the financial sector, which is particularly vulnerable to cyberattacks. According to the IMF’s 2024 Global Financial Stability Report, the number of cyberattacks has progressively increased since 2004, and nearly 20% of these attempts target financial institutions. DORA serves as a regulatory measure in the European Union (EU) to improve cybersecurity and operational resilience of organizations in the financial sector.

At Vanta, we power a suite of AI products that enable thousands of customers worldwide to make critical business decisions. These products rely on the ability to quickly search through millions of customer documents to surface relevant information and drive accurate outcomes. ‍ Building a retrieval system capable of handling this scale and complexity was no small feat. Along the way, we learned valuable lessons that we’re excited to share.

The Digital Operations Resilience Act (DORA) is a new regulation aimed at improving the cybersecurity and operational stability of the EU's financial sector, especially regarding risks related to information and communications technology (ICT). It applies to organizations in the financial industry, requiring them to reassess and adapt their security posture to DORA’s stringent requirements.

Startup founders constantly face competing demands as they build and scale their businesses. Engineering, product design, and sales all have legitimate claims to be the most urgent priority and sole focus of attention. ‍ These pressures lead many founders to defer security and compliance investments until later. With small teams and limited financial resources, founders top priorities are building their product and acquiring their first customers.

As a startup founder, it can be difficult to know when it’s time to expand your team. Sales and engineering were likely your top priority hires to fuel your product development and growth. But knowing where to focus next is often murky for early-stage startups. As you build your company, it becomes increasingly clear that security and compliance are vital parts of a successful business, but hiring for them can feel like a luxury instead of a necessity. ‍

The Digital Operational Resilience Act (DORA) is a mandatory EU regulation that aims to unify various information and communications technology (ICT) risk management frameworks into one comprehensive set of guidelines and requirements. ‍ The regulation is built around five pillars that strengthen and facilitate the digital and operational resilience of entities in the finance and insurance sectors.

As of January 17, 2025, all financial entities and their information and communication technology (ICT) service providers catering to EU entities must comply with the Digital Operational Resilience Act (DORA). ‍ If you’re new to the regulation, you can reduce the potential overwhelm caused by its various requirements by using a concise compliance checklist. To help, we’ve created a robust guide that covers everything you should know, including: ‍

The Digital Operational Resilience Act (DORA) is a comprehensive EU regulation aimed at financial entities and their third-party information and communications technology (ICT) providers. ‍ As a new and largely unexplored regulation, many affected organizations are still in the process of aligning their cybersecurity and risk management processes with the framework.