DORA Proportionality Principle

Proportionality in DORA means that the way a financial entity carries out its duties should fit its nature, scale, and complexity, and the risk of its services. It applies from 17 January 2025, alongside the rest of DORA, and it shapes how a risk assessment is written, how testing is designed, and how third-party oversight is organised. It does not create an exemption, and it does not mean that a smaller firm may leave a critical service lightly protected. The principle is a calibration tool, not a reason to do less where risk is high.

Think of two firms offering a comparable savings service, one a small insurer with a narrow product range and one a large banking group with many channels. Both need a view of ICT risk, a way of handling incidents, and a way of checking recovery, but the evidence, governance, and testing that fit one will look quite different from those that fit the other, and proportionality is the idea that explains why that difference is legitimate.

Financial entities differ enormously in what they do and how they do it, even when they share a category label. Some run a handful of services on a small number of systems, while others run many services across borders, channels, and providers, with data flowing between group companies and outside suppliers. A single rigid template for every firm would either overwhelm the small firm with irrelevant detail or leave the large firm with a framework too thin for its complexity. Proportionality answers that problem by tying the intensity of the work to the risk being managed, so that attention follows exposure rather than following a uniform checklist. A duty clearly calibrated to risk is easier to explain to staff and to a supervisor.

Several factors work together, and none of them decides the answer alone. Size matters, because a larger firm usually runs more services and more interconnections. Complexity matters, because a simple service on a single platform presents a different risk picture from a service stitched across many providers. The nature of the service matters, because a service that customers depend on for daily payments carries a different weight from an internal reporting tool. Risk profile matters most of all, because a service that is critical to customers, to markets, or to the firm itself deserves stronger treatment even when the firm is not large. A proportionate approach weighs those factors together and records the reasoning.

Proportionality does not excuse a missing risk view, a missing incident process, or a missing approach to third-party risk, and it does not turn a critical service into a minor one because the firm is small. It also does not mean that a firm may copy a larger firm's framework and call the result proportionate, since a framework designed for a different risk picture may hide the very risks that matter for this firm. A related misunderstanding is to treat proportionality as a one-off judgement made at the start of a project. Risk changes when services change, when providers change, and when incidents and tests reveal new weaknesses, so a proportionate approach needs revisiting. The judgement is only as good as the review that follows it.

In an ICT risk assessment, proportionality shows in the depth of analysis and in the choice of scenarios, with critical services receiving closer attention. In testing, it shows in the design of exercises, with the most consequential recovery paths receiving the most realistic rehearsal. In third-party oversight, it shows in the intensity of due diligence and monitoring, with providers behind critical functions receiving closer scrutiny than providers behind peripheral tools. In governance, it shows in who is involved, with senior attention focused where disruption would hurt most. In each case the outward sign is the same: a reader can trace a line from a service, through its risk, to the work done, and can see why that amount of work was judged enough.

Three questions offer a practical check. First, can the firm explain, in plain terms, why its approach fits the risk of each important service, rather than pointing only to its size? Second, would the explanation still hold if the critical service failed at an awkward moment, with the information the firm would actually have? Third, has the approach changed after an incident, a test, or a change in providers, or has it stayed exactly the same while the risk picture moved? If the answer to the first two questions is clear and the third shows a record of revision, the approach has the hallmarks of proportionality. If the reasoning is thin, the critical service is treated like any other, or nothing has changed for a long time, the label may be doing more work than the reasoning.