Log Management for DORA Compliance

Log management appears to be a vital component of DORA compliance. But how exactly does it contribute? In this article, we break down key parts of the DORA regulation to show where and how log management plays a critical role in meeting its requirements.

What is DORA?

The Digital Operational Resilience Act (DORA) is an European Union regulation aimed at strengthening the financial sector’s ability to withstand and recover from ICT-related disruptions.

It establishes uniform requirements for managing ICT risks, handling incidents, testing cyber defenses, overseeing third-party providers, and sharing threat intelligence.

Compliance with DORA’s obligations requires robust ICT risk management, timely incident reporting, regular threat-led penetration testing (TLPT), and cyber threat information sharing.

The Act became effective on January 17, 2025, and applies to a wide range of financial entities operating in the European Union. It is another regulation within the European Union that focuses on cybersecurity. It complements the broader NIS2 directive by introducing more detailed, financial sector-specific requirements to strengthen digital operational resilience.

How Log Management Relates to the DORA Regulation?

Log management plays an essential role in meeting DORA requirements, as the regulation requires financial entities to maintain strong detection, alerting, analysis, and visibility capabilities.

In particular, practices such as centralized log collection, real-time monitoring and alerts, long-term log retention with audit trails, and anomaly detection analytics directly support DORA compliance.

Let’s examine specific provisions of the DORA regulation where log management plays a key role in ensuring IT compliance.

Key DORA Obligations and Resilience Requirements

Below we provide a structured overview of DORA’s obligations with relation to the log management tools and illustrate with practical examples how effective log management helps fulfill those obligations.

1. Governance and Organizational Framework (Article 5)

This article makes the management body accountable for defining, approving, overseeing, and being continuously informed about ICT risk management.

Relation to log management: Centralized log management tools, such as Logmanager, provides visibility into system activities, incidents, and anomalies, enabling management to make informed decisions. Log data feeds dashboards and risk reports that support oversight and compliance monitoring.

2. CT Risk Management Framework (Article 6)

This article defines the core of the ICT risk management framework, including identification, protection, detection, response, recovery, and learning.

This framework mandates entities to address ICT risks quickly and effectively and ensure a high level of digital resilience. In practice, DORA’s risk management requirements cover multiple functions:

• identification of ICT risks,
• protection and prevention measures,
• detection of anomalies,
• response and recovery,
• continuous learning, and information sharing.

Governance expectations are high. The management body is responsible for approving and overseeing the ICT risk strategy and must maintain sufficient knowledge of ICT risks and controls (Article 5).

Relation to log management: Logging supports multiple stages of the framework:

• Detection: Through real-time alerts and anomaly detection.
• Response: Logs help trace incident scope and impact.
• Recovery and learning: Historical logs enable root cause analysis and post-incident reviews.

3. ICT Systems, Protocols, and Tools (Article 7)

This article requires that ICT systems and tools are reliable, secure, and continuously monitored.

Relation to log management: Using log management to ensure the security and reliability of the IT environment is a common use case. Such tools ensure that systems are not only running but also actively monitored for security issues, performance degradation, or operational anomalies.

4. Detection of anomalous activities (Article 10)

Article 10 of the DORA regulation focuses on the ability of financial entities to promptly detect anomalous activities in their ICT systems that could indicate ICT-related incidents or risks.

Financial entities must:

• Implement mechanisms to detect anomalous activities in their ICT systems.
• Ensure these mechanisms are capable of real-time or near real-time monitoring and able to detect both internal failures and external attacks.
• Use automated monitoring tools where appropriate.
• Set predefined detection rules and thresholds to flag unusual behavior.
• Ensure that alerting mechanisms are in place to trigger prompt responses.

In essence, Article 10 requires financial entities to have robust, proactive monitoring and alerting systems that can rapidly detect and respond to ICT-related threats or incidents.

Relation to log management: In article 10, DORA explicitly requires mechanisms to “promptly detect anomalous activities” and ICT incidents. Centralized log management and log analysis are commonly used to provide early alerts for detecting threats and operational failures, as well as for conducting root cause analysis.

A real-life example of using log management in this way is Logmanager’s deployment at Telco Pro Services, a telecommunications operator. To learn more, read our case study.

5. ICT Incident Reporting and Management (Articles 17–20)

Handling ICT incidents is a core pillar of DORA. Financial entities must establish an ICT incident management process to detect, log, escalate, and notify ICT-related incidents and cyberthreats in a timely manner (Article 17).

All ICT-related incidents must be recorded and tracked internally. DORA requires procedures to “identify, track, log, categorise and classify ICT-related incidents according to their priority and severity” (Article 17).

Major incidents must be promptly reported to management bodies and eventually to the relevant competent authorities (Article 19). Such a report should include an explanation of the impact, the response, and any additional controls to be established as a result of the ICT-related incidents, as well as an assessment of possible cross-border impacts.

DORA also mandates post-incident reviews and the implementation of lessons learned (Article 16).

Relation to log management: Centralized and detailed logging is indispensable for DORA’s incident management and reporting. Log files provide the evidence and timeline needed to understand what happened, classify incidents, and comply with regulatory reporting timelines. Also to identify the affected services to report on the impact as well as root causes or potential hardening/preventative actions to avoid potential future threats.

6. Threat-Led Penetration Testing (TLPT) and Resilience Testing (Articles 24–27)

DORA introduces stringent digital operational resilience testing requirements. Institutions must conduct regular assessments, including Threat-Led Penetration Testing (TLPT) at least every three years (Article 26).

These red-team style exercises simulate real cyber-attacks to test detection, protection, and response capabilities. Entities must also address all weaknesses identified in testing through remediation plans (Article 27).

Relation to log management: Centralized log management is important for TLPT exercises. Log management systems provide alerts on suspicious activity, which is crucial for security monitoring. Stored logs also support the documentation and remediation required after the test.

7. Cyber Threat Information Sharing (Article 45)

DORA encourages financial entities to participate in cyber threat information-sharing arrangements on a voluntary basis (Article 45). The goal is to improve collective resilience by sharing Indicators of Compromise (IOCs), threat intelligence, and best practices across institutions.

Relation to log management: Logs enable businesses to extract actionable IOCs and detect indicators shared by others and also to extract that information in the same format. This enhances collaborative defense and aligns with DORA’s objective of increasing sector-wide preparedness.

Log Management and DORA: Key Takeaways

Centralized log collection

Supports: Articles 6, 10, 17, 24–27, 45 Centralized log management collects logs from across systems into a unified platform. This supports DORA’s requirement for consistent and integrated monitoring of ICT risks and incidents.

Real-time monitoring and alerts

Supports: Articles 6, 10, 17, 26 Real-time monitoring enables immediate detection of threats and anomalies. DORA mandates prompt detection and response, which this capability facilitates.

Log retention and audit trails

Supports: Articles 17–20, 26, 27 Retained logs and audit trails provide evidence for post-incident reviews, regulatory reports, and remediation activities.

Anomaly detection and analytics

Supports: Articles 6, 10, 20, 26, Anomaly detection enhances the ability to identify unknown threats, supporting continuous improvement and proactive incident management.

DORA requirement	How log management supports DORA compliance
Comprehensive ICT Risk Management (Articles 5–7)	Centralized log collection for visibility of ICT assets and threats. Continuous monitoring of logs to identify risks and control failures.
Incident Detection and Response (Articles 10, 17–20)	Real-time monitoring and alerting for anomaly detection. Incident logs and audit trails for classification, investigation, and remediation.
Incident Reporting (Major Incidents) (Articles 19–20)	Detailed logs for impact and cause analysis. Log retention for regulatory compliance and future review.
Threat-Led Penetration Testing (TLPT) (Articles 24–27)	SIEM and log analytics to detect simulated attacks.– Logging test outcomes and follow-up for proof of remediation.
Cyber Threat Information Sharing (Article 45)	IOC extraction from logs for intelligence sharing. Ingest shared threat data into log monitoring tools to detect new threats.

Tab 1: How Log Management Relates to DORA Requirements

Final Thoughts

DORA represents a comprehensive approach to digital operational resilience in the financial sector, and effective log management is a key pillar of compliance. 

Centralized log collection, real-time alerting, audit trails, retention, and analytics all support DORA’s goals of visibility, preparedness, and accountability. By aligning log management practices with DORA’s legal obligations, financial entities ensure they are both compliant and resilient in the face of growing cyber threats.

Logmanager is commonly used by organizations of all sizes to meet legal compliance requirements. If you want to learn more about how it can support your compliance with DORA, feel free to contact our specialists.