comment-lines-light-full - white comment-lines-light-blue
en
en Global
fr-be Belgium
da Denmark
fi Finland
de-de Germany
en-my Malaysia
nl Netherlands
no Norway
poland Poland
sv Sweden
en-gb UK
Free trial
COMPLIANCE

The Digital Operational
Resilience Act (DORA)

The financial sector plays a vital role in our economy but is prone to cyber threats. The European Union has introduced the Digital Operations Resilience Act (DORA) to mitigate these risks. This act aims to establish a standardized approach to managing Information and Communication Technology (ICT) by enforcing governance, risk management, and incident reporting regulations. The implementation of these rules will enhance protection against cyberattacks and contribute to the growth of our digital economy.

87%
of financial institutions are concerned with the security posture of their shared service providers.
43%
of senior bank executives don’t believe their bank is adequately equipped to protect customer data, privacy, and assets in the event of a cyberattack.
13%
of the total number of security incidents in 2019 affected companies in banking and finance.

Strengthening operational resilience in the financial sector

The Digital Operational Resilience Act (Regulation (EU) 2022/2554) addresses a crucial issue in EU financial regulation. 

  • DORA mandates that financial institutions manage all aspects of operational resilience, including protection, detection, containment, recovery, and repair capabilities against ICT-related incidents.
  • DORA establishes guidelines for ICT risk management, incident reporting, operational resilience testing, and ICT third-party risk monitoring.
  • The regulation recognizes that a lack of operational resilience and ICT incidents can threaten the financial system's stability, even if adequate capital exists for traditional risk categories.
Continuous improvement
Overview

What is applicable?

EU regulation

DORA entered into force as a new regulation at the European level and must be applied equivalently in all EU countries.

Timeframe

DORA was hammered out in January 2023 and had a 24-month implementation period. Organizations had to be ready at the latest January 2025.

Penetration testing

Article 23 and article 24 (threat-based penetration tests) only came into force 36 months after the regulation's publication date.

We'll help you comply with DORA

Start your compliance journey today.

Start a free trial Request a quote

Strengthen your digital operational resilience

Financial institutions need to comply with DORA by doing the following: 

  • Review and improve the resilience level of their current ICT landscape.
  • Update their internal policies, procedures, and governance and control framework to implement DORA's requirements. Management must define, approve, oversee, and take responsibility for this process.
  • Establish an ICT-related incident management process to detect, track, log, categorize, classify, and notify ICT-related incidents in accordance with DORA.
  • Ensure that any contractual (outsourcing) arrangements comply with DORA.
DORA sections

Preparing for DORA

Anticipate disruption

To become operationally resilient, companies must first acknowledge that disruptive events are inevitable. Preparation is critical to being able to withstand disruptions that will inevitably occur.

Third-party
risks

Third-party supplier risks evolve with their products and services. Relying only on yearly assessments results in a loss of control. To maintain control, financial entities should continuously assess their third-party ecosystem.

A multidisciplinary approach

By adopting a unified and dynamic approach and a framework encompassing all domains, businesses can achieve advanced operational resilience even in a fast-paced environment where new risks emerge regularly.

Key obligations

Financial entities must adhere to DORA, which mandates the implementation of a thorough ICT risk management framework to manage ICT risks.

virtual technical graph and chart for technology investment
Man using Data Management System on computer
Lock and bnary code on screen
Outsourcing Concept Globe
ICT RISK MANAGEMENT

Manage a multitude of ICT risks

Financial firms must establish a comprehensive ICT risk management system, which includes:

  • Install and maintain resilient ICT systems and tools that minimize the impact of ICT risks.
  • Identify, classify, and document mission-critical functions and assets.
  • Continuously monitor all sources of ICT risks in order to take preventive protection measures.
  • Ensure immediate detection of abnormal activities.
  • Put in place an adapted and comprehensive business continuity policy with crisis and recovery plans, including annual testing of the plans, covering all supporting functions.
  • Establish mechanisms to develop and learn from external events as well as the company's own ICT incidents.
INCIDENT REPORTING & Information Sharing

Reporting in the financial sector

Financial companies are obligated to:

  • Develop an agile process to log/classify all ICT incidents and determine major incidents as specified by the regulation and the European supervisory authorities (EBA, EIOPA, and ESMA).
  • Submit initial, interim, and final reports on ICT-related incidents.
  • Adapt the reporting of ICT-related incidents through standard templates developed by ESA.
DIGITAL OPERATIONAL RESILIENCE TESTING

Adherence to annual testing protocols

  • Annually perform basic tests of ICT tools and systems.
  • Identify, prevent, and immediately eliminate any weaknesses, deficiencies, or gaps in the implementation of countermeasures.
  • Regularly perform advanced penetration tests (TLPT) for ICT services that affect critical functions. Third-party ICT service providers must participate and fully cooperate in the testing activities.
Third-Party Management

Navigating third-party ICT services

Financial companies must:

  • Ensure control of risk arising in connection with ICT services from third-party providers.
  • Report all outsourced activities and all changes that occur regarding critical ICT services from third parties; take into account IT risks that may arise when hiring subcontractors; merge essential parts of the ICT services and third-party provider relationships for complete monitoring.
  • Ensure that the contract with the third-party provider has a detailed and full information service level (where data is handled, etc.).
  • Business-critical third-party providers of ICT services fall under the so-called Union Oversight Framework, which can issue recommendations to reduce ICT risks. Financial companies must consider the risks associated with third-party providers who do not follow the guidance.

Safeguard your business from cyberattacks

Extend visibility

Know what you're up against. We can help you identify your IT system's weak points, categorize the assets that are vulnerable, and pinpoint the most likely threats. This knowledge will help you take action to proactively protect your business. 

Prioritize action

Identifying risks is just the first step; you need to act on them. We can help you develop a clear action plan that prioritizes your actions based on the level of threat, potential impact, and resources.

Communicate risk

Don't keep cybersecurity risks a secret - communication is key. Get a clear view of your business' cyber risk with Holm Security. Our platform provides security executives and business leaders with centralized and business-aligned insights, including actionable insights into your overall risk.

FAQ

What you need to know

What direct or indirect effects will DORA have on my business as an ICT service provider in the supply chain?

DORA aims to improve cybersecurity and resilience in the financial sector, including ICT service providers like you. This will indirectly impact you in terms of contracts and compliance requirements. Financial entities will review their contract agreements with you, so you should ensure your contracts align with DORA requirements. You'll be subject to DORA and other oversight requirements and are considered a critical supplier. To comply, you must work closely with financial entities and ensure all DORA requirements are met.

Which law prevails between DORA and NIS2?

The NIS2 Directive strengthens cybersecurity requirements across the EU and sectors, including banks and financial market infrastructures. DORA is the "lex specialis" of NIS2, meaning that a specific law takes precedence over a general one. In practice, DORA complements and clarifies NIS2 more than it supplants it.

According to DORA's Recital 16, "This Regulation constitutes lex specialis concerning Directive (EU) 2022/2555. At the same time, it is crucial to maintain a strong relationship between the financial sector and the Union horizontal cybersecurity framework as currently laid out in Directive (EU) 2022/2555."