The clock is ticking on Digital Operational Resilience Act (DORA) compliance

You don’t have to be an enthusiastic astrologist or a tarot card reader to be fixated on specific dates. Sometimes, dealing with compliance is enough to provide the fixation. Take, for example, 17 January 2025. 

If your organization operates within the EU’s financial sector, you’ll already know this date. It’s when the Digital Operational Resilience Act (DORA) becomes applicable. It really is going to be a big deal. If it was a Marvel movie, we’d be saying something like, “With great regulations comes great responsibility.” 

And indeed it does. DORA requirements concern the dimensions of People, Processes, and Technology alike (by the way, check out how Zoreza Global’s Lead Solutions Architect, Glen Stokes, broke them down into 234 items). Furthermore, with the DORA regulation in place, your organization’s leadership will also become directly responsible for managing ICT risks – and ensuring compliance. 

Nothing quite matches the excitement of a new regulatory compliance deadline, right? So you’d better come prepared – and just to help you along the way, here’s everything you need to know to get ready for the Digital Operational Resilience Act (DORA).

Let’s start with the basics. The Digital Operational Resilience Act (DORA), or the EU Regulation 2022/2554, is a new EU legal framework. It ensures the digital operational resilience of the EU’s financial system. It comes with new technical standards and obligations regarding ICT risk management. In addition, it covers incident response and reporting on financial institutions and their critical ICT third-party service providers. 

To cut a long story short: it’s a set of rules to guarantee the EU financial system stays strong in the face of digital difficulties. 

DORA EU regulation is designed to be a comprehensive ICT risk management framework for all financial entities operating in the EU financial sector. 

The organizations subject to DORA compliance have to implement specific technical standards to ensure their digital operational resilience by 17 January 2025.  

Hence, tick tock, tick tock…  

DORA requirements can be grouped into four categories:  

• ICT risk management and governance  
• Incident response and reporting  
• Digital operational resilience testing 
• Third-party risk management 

The fifth pillar of DORA, information sharing, is voluntary. 

ICT risk management and governance 

Now, to the fun part. An organization’s board members, executives, and senior managers bear the “ultimate responsibility” for its ICT risk management. Do they have to define and implement risk management strategies? Yes—but there’s more. Leaders can be held personally accountable for any failure to comply with DORA. 

Bear in mind the following. DORA’s ICT risk management requirements for financial entities include: 

• Developing and implementing a comprehensive and well-documented ICT risk management framework that aims to minimize ICT risk 
• Setting up an independent control function to oversee and manage ICT risk 
• Documenting and reviewing the ICT risk management framework at least once a year 
• Using and maintaining up-to-date, reliable, appropriate, technologically resilient ICT systems, protocols, and tools 
• Continuously monitoring the security and functioning of ICT systems and tools 
• Deploying security tools, policies, and procedures to minimize the ICT risk and promptly detect anomalous activity 
• Establishing a comprehensive ICT business continuity policy as part of an ICT risk management framework 
• Defining backup policies and procedures, as well as restoration and recovery procedures and methods 
• Putting in place crisis communication plans for major ICT-related incidents 

Certain small financial entities are exempt from Articles 5 to 15 of DORA. They can instead put in place a simplified ICT risk management framework, as per Article 16. Those entities include: 

• Small and non-interconnected investment firms 
• Payment institutions exempted under the EU Directive 2015/2366 
• Electronic money institutions exempted under the EU Directive 2009/110/EC 
• Small institutions for occupational retirement provision 

ICT-related incident classification, response, and reporting 

DORA security requirements mandate financial entities to put in place appropriate systems to monitor, manage, record, classify, and report ICT-related incidents. 

DORA also outlines the specific criteria which need to be taken into account when classifying ICT-related incidents: 

• Duration, including service downtime 
• Number of clients/transactions affected 
• Reputational impact 
• Geographical spread, including whether it affects more than two EU member states 
• Data losses entailed 
• Criticality of the services affected 
• Direct and indirect costs and losses, both absolute and relative 

In the event of a major ICT-related incident, financial entities must report it to a competent authority (state regulator or the ESAs). Reporting significant cyber threats remains voluntary. 

Digital operational resilience testing 

Financial entities are required to regularly test their ICT systems to ensure their resilience in the face of cyber threats. 

DORA operational resilience testing requirements include: 

• Testing all critical systems at least once a year 
• Ensuring the independence of internal or external parties conducting tests 
• Establishing procedures and policies to prioritize, classify, and remedy all issues revealed during testing 

Digital operational resilience testing can include: 

• Vulnerability and network security assessments 
• Gap analyses 
• Physical security reviews 
• Source code reviews (where feasible) 
• Scenario-based tests 
• Compatibility testing 
• Performance testing 
• End-to-end testing 
• Penetration testing 

Financial entities considered critical to the health of the financial system will also be required to conduct threat-led penetration testing (TLPT) once every three years. Third-party ICT service providers will also have to participate in these tests. 

The technical standards for TLPT are still in the works. 

ICT third-party risk management 

In plain words, it’s getting harder and harder to blame someone else. 

Requirements for managing ICT third-party risk are what sets DORA apart in the regulatory landscape. The act mandates financial entities to factor in ICT third-party risk in their risk management framework. What’s more, they remain fully responsible for DORA compliance even when external ICT services are involved. 

DORA requirements on managing ICT third-party risk include: 

• Adopting and regularly reviewing an ICT third-party risk management strategy 
• Maintaining a register of information on all ICT third-party contractual arrangements
• Reporting new contractual arrangements to competent authorities at least once a year (if those services support critical business functions – “in a timely manner”) 
• Identifying and assessing risks before entering a contract with a third-party service provider 
• Ensuring the provider follows appropriate security practices before entering a contract 
• Including specific exit strategies, audits, and performance targets in the contractual provisions 

Information sharing arrangements 

While DORA authorizes information exchange on significant cyber threats between financial entities, it doesn’t make intelligence sharing mandatory. However, if you do choose to share intelligence, keep business confidentiality in mind (e.g.: privacy regulations like GDPR): the data has to be anonymized before sharing.