1

What is DORA, and how will it impact your business?

Are you in the financial sector, or do you do business with them? DORA, a new EU regulation, is here to improve cybersecurity and resilience. But how will it impact your organization?

Cybersecurity threats are constantly rising in today's rapidly evolving threat landscape. This is especially true for businesses operating in the financial sector, as the stakes are higher than ever before. 

As such, the European Union (EU) has taken a significant step towards improving the cybersecurity resilience of financial institutions with the introduction of the Digital Operational Resilience Act (DORA).

DORA sets a new standard for operational resilience across the EU financial ecosystem. But what exactly is DORA, and how will it impact your business?

What is DORA?

DORA, or Digital Operational Resilience Act, is a regulation established by the EU that creates a comprehensive and binding information and communication technology (ICT) risk management framework for financial institutions operating within the region.

DORA outlines technical guidelines that financial institutions and their key technology service providers need to follow for their IT systems. Although DORA came into force on January 16, 2023, it won't fully apply until January 17, 2025.

What does this mean?

This means financial institutions in the EU have some time to prepare their IT systems and comply with the cybersecurity regulations outlined in DORA.

What's the purpose of DORA?

The primary objective is to ensure that the financial services industry, market infrastructure providers, and other relevant third parties are well-equipped to withstand and respond effectively to disruptions caused by:

  • Cyberattacks
  • IT failures
  • Natural disasters
  • Other unforeseen events

DORA emphasizes a proactive approach, requiring institutions to have robust plans in place to prevent, mitigate, and recover from operational disruptions. This shift towards a more holistic view of risk management is a significant step forward for the financial sector's overall stability.

Key components of DORA: what you need to know

DORA comprises five key pillars that lay the foundation for a more resilient financial system:

1: Rethinking risk management

DORA mandates a reassessment of existing risk management practices. Institutions must evaluate their governance structures, policies, internal controls, and risk assessments to address operational risks in the digital age effectively.

2: Strengthening incident reporting

DORA introduces stricter rules for handling ICT incidents. The scope extends beyond the General Data Protection Regulation (GDPR) to encompass a broader range of incidents. Additionally, DORA encourages voluntary reporting of cyber threats, fostering information sharing and collaboration within the industry.

3: Third-party risk management

DORA acknowledges the increasing reliance on third-party vendors for critical services. The EU cybersecurity act requires institutions to conduct thorough risk assessments of their third-party ICT service providers. Contracts with these providers must clearly define service level expectations, data processing locations, and incident reporting protocols.

4: ICT risk management

DORA outlines specific requirements for managing ICT risks. This includes implementing robust cybersecurity controls, conducting regular testing and vulnerability assessments, and maintaining business continuity and disaster recovery plans.

5: Supervisory oversight

DORA empowers national competent authorities (NCAs) within the EU member states to oversee and enforce DORA compliance. NCAs will have the authority to conduct inspections, request information, and impose sanctions for non-compliance.

How will DORA impact your business?

While DORA primarily targets financial institutions within the EU, its influence will likely be felt globally. Here's why your business might be affected:

Global financial interconnectivity

The financial sector is inherently interconnected. If you do business with EU financial institutions, you'll likely need to adapt your practices to comply with DORA's requirements, even if you're not in the EU.

Enhanced security standards

DORA sets a higher bar for cybersecurity and operational resilience. By complying with DORA indirectly, you can demonstrate a commitment to robust security practices, potentially improving your reputation and attracting new business opportunities.

Third-party risk management

DORA emphasizes the importance of managing third-party risk. You may need to adapt your contracts and communication protocols with third-party vendors to align with DORA's guidelines.

Preparing for DORA: act now!

The official enforcement date for DORA is January 17, 2025. However, it's crucial to start preparing now. It might help to do the following:

  1.  Familiarize yourself with DORA.
  2. Carefully review the DORA regulation and understand its specific requirements.
  3. Assess your current practices: Evaluate your existing risk management, incident reporting, and third-party vendor management practices to identify gaps.
  4. Develop a DORA compliance plan:  Create a comprehensive plan outlining the steps you must take to achieve compliance with DORA. This might involve developing new policies, conducting risk assessments, or upgrading your cybersecurity infrastructure.
  5. Seek expert advice: Consult with legal and compliance specialists experienced with DORA to ensure your approach aligns with the regulation.

Building a more secure future for financial services

DORA siginifies a significant leap forward in strengthening the EU financial sector’s operational resilience. While compliance may require adjustments, the long-term benefits are undeniable. 

A more secure and resilient financial system fosters trust, stability, and a healthier financial ecosystem for all stakeholders. Proactively preparing for DORA ensures your business remains competitive and contributes to a more secure financial future.

to top