DORA Compliance: Benchmarking Data Center Resilience for a Tier-1 Spanish Bank

The challenge

DORA introduced strict requirements for ICT risk management, disaster recovery and operational continuity for EU financial institutions. Its 2025 application date was fixed, and many architecture decisions made before it would be expensive or impossible to reverse later.

The bank ran a multi-site architecture combining physical data centers and cloud services. Disaster recovery existed, but there was no clear picture of whether the design met DORA’s requirements, or how it compared with what other Tier-1 European banks were doing. Those banks were taking very different paths: traditional physical recovery sites, hybrid models and cloud-native approaches.

My task: as an independent expert, show the bank where it stood against the regulation and against its peers before it committed to a direction.

What is DORA?

The Digital Operational Resilience Act, or Regulation (EU) 2022/2554, is the EU law on how financial institutions manage technology risk. It has applied since 17 January 2025 to banks, insurers, investment firms and other financial entities, and to the technology providers they depend on. It covers ICT risk management, incident reporting, resilience testing and the risk of relying on third-party providers such as cloud services.

For data centers and disaster recovery, two articles matter most. Article 11 asks for an ICT business continuity policy, with continuity and recovery plans tested at least once a year. Article 12 covers backup and recovery: every financial entity except the smallest must keep redundant ICT capacity, and its recovery time and recovery point objectives must still meet the agreed service levels in extreme scenarios. For some market infrastructures, such as central securities depositories, Article 12 also asks for a secondary site far enough from the primary one that the same event cannot hit both. Banks get no fixed distance, so they have to judge for themselves whether one event could hit both sites.

What I did

1. Assessed the data center and disaster recovery architecture

   Together with the bank’s infrastructure, risk and business continuity teams, I reviewed the multi-site data center setup across physical and cloud environments. I assessed disaster recovery and isolated recovery environment (IRE) readiness against technical and operational criteria, including whether the recovery time and recovery point objectives of critical functions would hold in the extreme scenarios DORA asks for. Sites located close to each other got particular attention: under simultaneous-failure scenarios, proximity creates its own risk.

   Technical details

   • Isolated recovery environment (IRE): a separate, isolated environment from which critical systems can be restored after a severe incident such as a cyberattack. DORA Article 12 asks that backup data is restored on ICT systems that are physically and logically separated from the source system, which is the same idea.
   • Proximity risk: data center sites less than one kilometer apart can be hit by the same event, a scenario that day-to-day operations never test. DORA uses the same idea when it asks some market infrastructures for a secondary site that the same event cannot reach.

2. Benchmarked the bank against leading European banks

   A structured comparison with Tier-1 European peers on ten dimensions, with each peer’s setup mapped against the relevant DORA articles, so the comparison was based on regulation as well as on operations.

   The ten dimensions

   • Disaster recovery operating cost ratios
   • Power usage effectiveness (PUE): how much of a data center’s energy reaches the IT equipment
   • IT floor utilisation
   • RTO and RPO alignment: recovery time objective (how quickly a service must be back) and recovery point objective (how much data may be lost)
   • Minimum viable business (MVB) coverage: the services the bank must keep running during a disruption
   • Automation levels
   • Fallback readiness
   • Third-site usage patterns
   • Public vs private cloud recovery adoption
   • Cost models comparing physical and cloud-based recovery

3. Mapped the gaps and framed the investment decisions

   Mapped the bank’s current state against more than eight DORA articles and the local Banco de España guidance, and separated the gaps into three groups: changes required before the deadline, optional improvements, and areas misaligned with the bank’s own business-continuity expectations. Each finding was translated into business impact (cost, risk and operational flexibility), so design choices could be compared on all three at once. I presented the findings and recommendations to the bank’s decision-makers.

Results

The value of this work was its timing: it came before the deadline, while design choices could still be made. The bank came away with:

• A clear map of its gaps against DORA and Banco de España guidance.
• Clear priorities: what had to change before the deadline, what was optional, and what was misaligned with its own continuity expectations.
• A quantitative peer comparison showing where its recovery setup stood against leading European banks on ten dimensions.
• Its most critical risk made visible: the proximity of closely located data center sites, which never shows in day-to-day operations.
• Every finding in business terms (cost, risk and operational flexibility), ready for design and investment decisions.
• Recommendations delivered before the deadline, while the design was still open.

What I learned

Regulatory requirements expose weaknesses that normal operations never reveal.

A disaster recovery architecture that has never failed is not necessarily one that will hold under the conditions regulators test for: simultaneous failure, sites too close to each other and chains of dependencies collapsing together. And recovery models that look equal on paper are not: two banks with the same recovery-time commitment can be operating at three times the cost, with very different confidence that recovery will actually work. That is why benchmarking belongs before the decision. You don’t do it to copy peers, but to see the real range of options before your own choices narrow it.

Evidence and further reading

• Article · this siteArchitecture in an Unstable World: a practical framework for geopolitical riskHow regulation such as DORA becomes an input to architecture decisions.
• Related projectEmergency cloud migration of a core banking platform during the outbreak of war in UkraineBanking resilience under real stress.

“Architecture in an Unstable World” was also published on CloudTweaks.

Skills and technologies

• DORA compliance
• Operational resilience
• Data center resilience
• Disaster recovery
• Isolated recovery environments (IRE)
• RTO / RPO
• Business continuity
• ICT business continuity
• Redundant ICT capacity
• Peer benchmarking
• Regulatory gap analysis
• Banco de España guidance
• Cloud vs physical recovery economics
• Investment decision support
• Independent advisory
• Tier-1 banking

← All projects