DORA Regulation: Multi-AZ vs Multi-Region for Disaster Recovery

DORA, the EU's Digital Operational Resilience Act, does not mandate specific architectures like multi-AZ or multi-region for disaster recovery. Instead, it requires financial entities to set recovery time and point objectives per function and prove they can meet them. The regulation's secondary processing site requirement applies only to central securities depositories and central counterparties, not typical banks or SaaS vendors.