> For the complete MongoDB documentation index, see www.mongodb.com/docs/llms.txt # DORA Compliance The Digital Operational Resilience Act (DORA) is a set of regulations that the European Union (EU) adopted to help ensure the digital operational resilience of financial institutions and service providers. **Note:** The MongoDB Atlas Shared Responsibility Model defines the complementary duties of MongoDB and its customers in maintaining a secure and resilient data environment. Under this framework, MongoDB manages the security and operational integrity of the underlying platform, while customers are responsible for the configuration, management, and data policies of their specific deployments. For a detailed breakdown of ownership across security and operational excellence, see [Shared Responsibility Model.](https://www.mongodb.com/resources/products/fundamentals/shared-responsibility) DORA applies to a wide range of regulated financial services providers within the EU, such as banks, credit institutions, payment institutions, investment firms, and asset management companies. It also covers entities like crypto-asset services providers, trading venues, and credit rating agencies. The key requirements for DORA fall under five pillars: information and communication technology (ICT) risk management, ICT-related incident reporting, digital operational resilience testing, ICT third-party risk management, and information sharing. **Important:** To learn more about how MongoDB can support you with DORA compliance, including information on contractual agreements, see the [EU Digital Operational Resilience Act (DORA)](https://www.mongodb.com/products/platform/trust/dora) page in the MongoDB Trust Center. ## Pillar 1: ICT Risk Management DORA requires regulated companies to establish a framework to identify, assess, and mitigate ICT risks. This framework includes conducting regular risk assessments, implementing controls to address identified risks, and having a plan for incident response. The following MongoDB Atlas features support compliance in this area. - [High availability](https://www.mongodb.com/docs/atlas/architecture/current/high-availability.md#std-label-arch-center-high-availability) including database replication and automatic failover. - [Disaster Recovery](https://www.mongodb.com/docs/atlas/architecture/current/disaster-recovery.md#std-label-arch-center-dr) including cloud backups, continuous cloud backups, multi-region snapshot distribution, backup compliance policy, and recovery point objectives, and recovery time objectives. - [Features to support compliance with external standards](https://www.mongodb.com/docs/atlas/architecture/current/compliance.md#std-label-arch-center-compliance) including ISO/IEC 27001, SOC2 Type II, and PCI DSS. - [Network security](https://www.mongodb.com/docs/atlas/architecture/current/network-security.md#std-label-arch-center-network-security) including TLS/ SSL encryption, IP access lists, firewall configuration, and private endpoints. - [Authentication](https://www.mongodb.com/docs/atlas/architecture/current/auth/authentication.md#std-label-arch-center-authentication-recs) including UI, database, API, federated, AWS IAM role, multi-factor, and SCRAM password authentication. This feature and guidance also includes X.509 certificates, API keys, and secrets management. - [Authorization](https://www.mongodb.com/docs/atlas/architecture/current/auth/authorization.md#std-label-arch-center-authorization-recs) including Role Based Access Control (RBAC), pre-defined roles, federated identity providers, and just-in-time access. - [Auditing](https://www.mongodb.com/docs/atlas/architecture/current/auditing.md#std-label-arch-center-auditing) including database auditing, creating and enabling audit filters, and recommended audit events. - [Logging](https://www.mongodb.com/docs/atlas/architecture/current/logging.md#std-label-arch-center-logging) including accessing audit logs manually and programmatically. - [Data encryption](https://www.mongodb.com/docs/atlas/architecture/current/data-encryption.md#std-label-arch-center-data-encryption) including encryption in transit (TLS), at rest (AES-256, BYOK, CMK, KMS, or TDE), and in use (CSFLE, random, and queryable encryption). ## Pillar 2: ICT-Related Incident Management DORA requires regulated companies to have processes in place to detect, report, and investigate ICT-related incidents. These processes include having clear reporting channels, procedures for classifying incidents based on severity, and timely notification to relevant authorities. MongoDB Atlas supports the following aspects of this pillar: - [Authentication.](https://www.mongodb.com/docs/atlas/architecture/current/auth/authentication.md#std-label-arch-center-authentication-recs) - Data localization. - [Encryption in transit or volume.](https://www.mongodb.com/docs/atlas/architecture/current/data-encryption.md#std-label-arch-center-data-encryption) - [Network isolation.](https://www.mongodb.com/docs/atlas/architecture/current/hierarchy.md#std-label-arch-center-hierarchy) - [Granular auditing.](https://www.mongodb.com/docs/atlas/architecture/current/auditing.md#std-label-arch-center-auditing) - [Data backup.](https://www.mongodb.com/docs/atlas/architecture/current/disaster-recovery.md#std-label-arch-center-dr) - Platform security. - [High availability.](https://www.mongodb.com/docs/atlas/architecture/current/high-availability.md#std-label-arch-center-high-availability) - [Autoscaling.](https://www.mongodb.com/docs/atlas/architecture/current/scalability.md#std-label-arch-center-scalability) - Distributed architecture. Your chosen cloud provider(s) supports the following aspect of this pillar: - Physical security. ## Pillar 3: Digital Operational Resilience Testing DORA requires regulated companies to conduct regular testing of their ICT systems and resilience measures. The following MongoDB Atlas features support compliance in this area: - [Regional outage simulation.](https://www.mongodb.com/docs/atlas/tutorial/test-resilience/simulate-regional-outage.md#std-label-test-outage-process) - [Primary failover test.](https://www.mongodb.com/docs/atlas/tutorial/test-resilience/test-primary-failover/) ## Pillar 4: ICT Third-Party Risk Management DORA-regulated companies need to conduct due diligence on third parties, have contractual agreements outlining security expectations, and monitor their performance. The following MongoDB Atlas features support compliance in this area: - Sync data across cluster environments: - [Connect a Self-Managed Cluster to Atlas.](https://www.mongodb.com/docs/mongosync/current/connecting/onprem-to-atlas/) - [Connect Two Atlas Clusters.](https://www.mongodb.com/docs/mongosync/current/connecting/atlas-to-atlas/) - [Connect Two Self-Managed Clusters.](https://www.mongodb.com/docs/mongosync/current/connecting/onprem-to-onprem/) - [Multi-cloud deployment paradigm.](https://www.mongodb.com/docs/atlas/architecture/current/deployment-paradigms/multi-cloud.md#std-label-arch-center-paradigms-multi-cloud) - [Mongosync](https://www.mongodb.com/docs/mongosync/current/) (cluster-to-cluster sync). - [MongoDB Cloud Status](https://status.mongodb.com/) page. ## Pillar 5: Information Sharing DORA encourages collaboration and information sharing on cyber threats among regulated companies. This can involve participating in industry forums, sharing threat intelligence, and conducting joint exercises.