-1700575738.svg){kind=icon}
.svg){kind=icon}
DORA, or the Digital Operational Resilience Act, stands as the EU’s newest framework governing digital capabilities for financial entities. Its objective is to provide a uniform set of regulations across Europe, aiding financial institutions in maintaining resilient operations amidst an increasing reliance on ICT services.
DORA – At a Glance
Proposed by the European Commission in 2020, DORA received the official approval from the EU in November 2022, with the framework’s final touches expected by 2024. Relevant parties are expected to adhere to the regulations by 16/1/2025, which is just under a year from now.
While certain specific technical standards of the act are still under consultation, what we do know is that DORA concentrates on five pivotal aspects, each addressing facets of a financial entity’s Information and Communication Technology (ICT) related operations.
ICT Risk Management
With the new act in action, the responsibility falls upon the executive leadership for orchestrating the organisation’s ICT management. Their duties extend to formulating risk management strategies and ensuring an effective implementation of them. If things go wrong, individual executives can be held personally accountable for their shortcomings in the delivery of the above.
Financial entities are mandated to establish and sustain a comprehensive ICT risk management framework, which includes mapping out their ICT systems, pinpointing crucial assets and functions, documenting dependencies across assets and providers, conducting routine risk assessments, and crafting mechanisms for continuous learning and evolution, exemplified by the development of disaster recovery plans.
Incident Response and Reporting
Entities must establish structured processes for overseeing, logging, managing and reporting ICT incidents. The recorded incidents will undergo classification based on forthcoming criteria, drafted by the authorities.
Depending on severity, entities may be required to formulate reports in specific formats for notifying users, clients, and authorities. These documents will be used in facilitating in-depth causal analyses to prevent future incidents.
Resilience Testing
All tech services and systems used will need regular check-ups for vulnerabilities. Outcomes must be handed over to the governing body for validation. Any identified deficiencies require immediate rectification.
Organisations deemed critical to the financial system, along with their critical ICT providers, will undergo Threat-led Penetration Testing (TLPT) every three years in addition to the regular assessments, in favour of addressing the higher stakes of risk exposure.
Third-party Risk Management
Entities will play a more proactive role in managing risks tied to third-party ICT services. If the company’s crucial functions rely on these outsourced elements, the negotiation of specialised contractual arrangements – such as exit strategies and audits – is imperative. A meticulous mapping of third-party ICT dependencies is also vital for ensuring firms are not disproportionately relying on external providers
ICT service providers failing to meet the requirements will be ineligible to enter into contracts with any covered entities. Critical third-party providers, additionally, will be subject to direct oversight by the governing authority.
Information Sharing Arrangements
For the timely lowdown on the latest from both internal and external ICT incidents, structured processes need to be in place to make sure that entities can swiftly prepare for any emerging challenges.
In line with DORA’s principles, organisations are strongly encouraged to participate in a voluntary threat intelligence sharing arrangement. The collaborative effort aims to enhance the efficiency of information sharing among financial institutions, fostering a collective approach toward addressing upcoming threats in the ICT landscape.
