The Digital Operational Resilience Act (DORA) – Regulation of the European Parliament and of the Council imposes a number of obligations on financial entities related to information and communication technology (ICT) security. However, some of these entities are excluded from the scope of DORA, e.g. due to the size of their capital or assets under management. Others may be excluded from the scope of DORA by a Member State under a national option. In addition, the legal standards of DORA express the principle ofproportionality and indicate which characteristics of a financial entity are to be taken into account in fulfilling the obligations under DORA. The aim of the article is to present these obligations and the rationale under which the principle of proportionality applies to the entities regulated by this legal act. The research thesis of the article is that the principle of proportionality is regulated in DORA in a multifaceted manner. The article uses the dogmatic-legal method.