Acuna GRC core
ComplyFrameworks, scopes and cross-mapping.ImplementRequirements, measures and controls.OperateRisks, tasks, annual plan, documents.AssureKPIs, audits and corrective actions.
Platform overview
Add-on modules
TPRM (Supplier Shield)Supplier assessments and a daily grade.Data PrivacyProcessing activities, DPIAs and requests.Cookie ManagerCookie banner and consent records.Trust CenterAnswer questionnaires, share a trust page.AI GovernanceRegister and assess your AI systems.EvaluationsSpot checks and gap assessments.Group managementSubsidiaries in one Group Compliance view.Staff PortalPolicies staff read and acknowledge.Vulnerability managementScanner results turned into issues.
All modules
Across the platform
AikoThe AI assistant, at your pace.Integrations and APIConnectors, task sync, webhooks, API.Administration and securityUsers, access profiles, audit log.100+ connectors
By size
StartupGet ready for your first audit.Mid-marketKeep the library clean as you grow.EnterpriseControl at scale.Consultants and MSSPsAll your clients in one view.
By framework
ISO 27001ISO 42001NIS2EU AI ActDORASOC 2GDPRNIST CSFSwiss FADPFINMA
See all frameworks
By need
Prepare for a certification auditAnswer a client questionnaireRun compliance across a groupAssess your suppliersGovern your AI systems
All solutions
Acuna GRC Services
Do it yourselfYou run the program in Acuna GRC, with Aiko.Done with you (Co-managed)Guidance, reviews and audit preparation with your team.Done for you (Fully managed)Our experts run it. You review.
What we take on
CISO as a serviceDPO as a serviceAudit preparationGap assessmentsProgram setup in Acuna GRC
Meet the experts
Alexis HirschhornCertified Lead AuditorLaura MenetreyLegal and privacy expertBénédicte SévinISO 27001 Lead Implementer
Meet the full team
MSSPs and consultants
Acuna GRC for MSSPsWhite label and tenant managementBecome a partner expert
Learn
BlogWebinarsAnswersGlossary
See all resources
Framework guides
ISO 27001NIS2DORAEU AI ActCyber Resilience Act
All frameworks
Featured
WebinarFrom AI hype to AI reality: governing the AI your company already usesView the webinarGuideHigh-risk AI systems: how the EU AI Act classifies yoursRead the guide
Company
About AcunaTeamPricingOur Trust CenterContact us
Legal
PrivacyTermsData Processing AgreementAcuna GRC AI information
Our own standard
ISO/IEC 27001:2022 certifiedThe standard you ask of your own suppliers.Built and run from SwitzerlandHosted in Switzerland, the EU or the US.
Switzerland

How does DORA compare to FINMA Circular 2023/1?

By the Acuna GRC teamLast updated 19 October 20262 min read

Direct answer

DORA is a directly applicable EU regulation with detailed rules for EU financial entities. FINMA Circular 2023/1 sets principles-based expectations for Swiss banks and securities firms, applied in proportion to their size. Both cover ICT risk, incident reporting, third-party risk, testing and the resilience of critical functions, but differ on deadlines, the provider register and testing.

DORA is a directly applicable EU regulation with detailed rules and technical standards for financial entities in the EU. FINMA Circular 2023/1 sets principles-based expectations for Swiss banks and securities firms, applied in proportion to their size. Both cover ICT risk, incident reporting, third-party risk, testing and the resilience of critical functions, but they differ on deadlines, the provider register and testing.

DORA (Regulation (EU) 2022/2554) has applied since 17 January 2025 to financial entities authorised in the EU, with regulatory technical standards that fix templates and thresholds. FINMA Circular 2023/1 Operational risks and resilience, in force since 1 January 2024, sets out how FINMA applies Swiss law to banks and securities firms. It is principles-based and scaled to the institution’s supervisory category. Insurers are not addressees of Circular 2023/1.

Where they differ

  • Incident reporting. DORA asks for an initial notification within 4 hours of classifying a major ICT incident and no later than 24 hours after becoming aware of it, an intermediate report within 72 hours and a final report within one month. FINMA Guidance 03/2024 asks for a first report of a cyberattack within 24 hours and a full report within 72 hours.
  • Third-party register. DORA requires a register of information on all ICT contractual arrangements in a standard template (Article 28). FINMA has no such template; outsourcing of significant functions follows FINMA Circular 2018/3 on outsourcing.
  • Testing. DORA requires threat-led penetration testing at least every three years for entities identified by their authority (Article 26). Circular 2023/1 expects regular vulnerability assessments, penetration tests and scenario-based exercises, without a TLPT regime.
  • Providers. DORA brings critical ICT providers under direct EU oversight. FINMA supervises the institution, which stays responsible for what it outsources.

Where they agree

Both ask the institution to know its critical functions, the processes, data and providers behind them, how long it can tolerate a disruption and how it recovers. Both expect the board to approve the framework, incidents to be classified and handled, and controls to be tested. A bank that has done the work for one usually has most of the evidence for the other.

Running both in Acuna GRC

In Acuna GRC you adopt DORA and FINMA next to each other in Comply. Common Measures are mapped across frameworks and Mapping lists the requirements of each that no measure covers yet. The business impact analysis records RTO, RPO and MTPD per process and the suppliers it depends on, the SPOF analysis shows shared dependencies, and incidents are issues with a timeline of dated steps. See FINMA compliance software and DORA compliance software.

How Acuna GRC handles it

In Acuna GRC both run in one programme, so a shared measure counts once for each.

Sources

  1. Regulation (EU) 2022/2554 (DORA), Articles 19, 26, 28 and 31
  2. FINMA circulars, including Circular 2023/1 and Circular 2018/3
  3. FINMA guidance, including Guidance 03/2024 on cyber attack reporting

This page explains the rules in general terms and is not legal advice.

Frequently asked

Is FINMA Circular 2023/1 the Swiss version of DORA?

No. It was written for Swiss banks and securities firms on its own timeline and is principles-based. The themes overlap, the rules and deadlines do not.

Can one register serve both?

Usually, if it holds what DORA asks for, since the DORA register of information is the more detailed of the two. Check it against the FINMA outsourcing rules for the providers of significant functions.

For: Security Leader (CISO)

See how Acuna GRC runs this.

Tell us your frameworks and your team. We show you how Acuna GRC runs the program.

Hosted in Switzerland, the EU or the US