Everything You Need to Know About The Digital Operational Resilience Act (DORA)

Sameer Ahirrao -

In today's digital era, cybersecurity goes beyond safeguarding data; it is crucial for maintaining the integrity and resilience of our financial systems against various threats. The European Union's introduction of the Digital Operational Resilience Act (DORA) represents a pivotal advancement toward creating a more secure and stable financial ecosystem. As seasoned cybersecurity professionals, we've seen the progression of digital threats and the growing complexity of cyber attacks. This context underscores the importance of DORA and its capacity to transform the cybersecurity landscape within financial services.

Understanding the DORA Act and Its Enforcement

DORA was officially approved in November 2022 by the European Parliament and the Council of the European Union, the primary legislative bodies responsible for enacting laws in the EU. Financial institutions and external ICT service providers have until January 17, 2025, to comply with DORA before enforcement begins.

The Digital Operational Resilience Act addresses the increasing reliance of financial entities on information and communication technologies (ICT). Its goal is to create a unified framework for digital operational resilience across all EU member states, ensuring that financial institutions can endure, respond to, and recover from ICT-related disruptions and threats.

DORA primarily addresses the following critical areas:

  • ICT Risk Management: Imposing strict requirements for financial entities to identify, manage, and mitigate risks related to information and communication technologies.
  • Incident Reporting: Requiring prompt reporting of major cyber incidents to relevant national and EU authorities.
  • Digital Operational Resilience Testing: Implementing rigorous testing protocols to evaluate the resilience of financial entities against cyber threats.
  • Third-Party Risk Management: Strengthening oversight and management of ICT third-party service providers, including those offering cloud computing services.

Although DORA has been officially endorsed by the EU, the European Supervisory Authorities (ESAs) are still addressing several key issues. These ESAs, which include the European Banking Authority (EBA), the European Securities and Markets Authority, and the European Insurance and Occupational Pensions Authority, are the regulatory bodies overseeing the EU financial sector.

The European Supervisory Authorities (ESAs) are responsible for drafting the regulatory technical standards (RTS) and implementation technical standards (ITS) that covered entities must follow. These standards are expected to be finalized in 2024. Additionally, the European Commission is anticipated to complete the development of an oversight framework for critical ICT providers by 2024.

Once the standards are finalized and the January 2025 deadline has passed, enforcement will be handled by the "competent authorities" or designated regulators in each EU member state. These authorities may require financial entities to implement security measures and address vulnerabilities. Entities that fail to comply will face administrative penalties and, in some cases, criminal penalties. The specific penalties will be determined by each member state individually.

ICT providers deemed "critical" by the European Commission will be directly supervised by lead overseers from the ESAs. These lead overseers have the same powers as the competent authorities to require security measures, enforce corrective actions, and impose penalties on noncompliant ICT providers. Under DORA, lead overseers can fine ICT providers up to one percent of their average daily global turnover from the previous fiscal year. These daily fines can be imposed for up to six months until the providers comply with the regulations.

Who Needs to Comply with the DORA Act?

The Digital Operational Resilience Act (DORA) primarily applies to entities within the financial sector of the European Union. It ensures that all participants in the financial system have robust safeguards against cyber threats. Here's a breakdown of who needs to comply with DORA:

  • Credit institutions: Banks and other entities offering credit facilities must ensure their digital operations are resilient against cyber threats.
  • Payment institutions: Organizations providing payment services must protect their payment processes from cyber disruptions.
  • Electronic money institutions: Firms issuing electronic money or facilitating electronic payments fall under DORA’s scope.
  • Investment firms: Companies offering investment services such as brokerage and portfolio management must adhere to DORA’s requirements.
  • Crypto-asset service providers: Entities involved in crypto-assets must ensure operational resilience.
  • Insurance and reinsurance companies: Insurers and reinsurers need to protect their operations from ICT-related risks.
  • Central counterparties and Central securities depositories : Entities involved in post-trade processing of securities transactions must ensure digital resilience.
  • Trading venues: Stock exchanges and platforms where financial instruments are traded must mitigate cyber risks.
  • Third-party service providers: Although not directly regulated by DORA, third-party providers (like cloud services) to regulated financial entities must adhere to resilience standards indirectly through their relationships with financial entities.
  • Other financial market participants: Various entities critical to the financial market infrastructure are subject to regulatory oversight to ensure operational resilience.

DORA establishes a thorough framework for operational and digital resilience throughout the financial sector, demonstrating the EU's dedication to protecting against ICT and cyber threats. Adhering to DORA not only strengthens the resilience of each entity but also bolsters the overall stability and integrity of the financial market as a whole.

DORA Act’s Implications for Financial Entities

For financial institutions throughout the EU, DORA represents more than just another regulatory measure — it signifies a significant evolution towards a cohesive and resilient cybersecurity framework. By standardizing requirements, DORA strives to create equitable conditions where all entities, regardless of their scale or intricacy, meet rigorous standards of digital resilience.

Implementing DORA will certainly pose challenges, especially for smaller institutions that may have fewer resources compared to larger ones. Yet, it also presents an opportunity to enhance defenses, refine incident response protocols, and cultivate a culture of ongoing enhancement and resilience.

The Cybersecurity Veteran’s Perspective

From the perspective of seasoned cybersecurity professionals, DORA marks a crucial and much-needed advancement. Operational resilience goes beyond mere defense against cyber attacks; it ensures that financial services can maintain functionality amid potential disruptions. DORA's holistic strategy encompassing risk management, rigorous testing, and oversight of third-party providers demonstrates a nuanced understanding of contemporary cybersecurity challenges.

Looking forward, we foresee DORA catalyzing innovation in cybersecurity methodologies and technologies. As financial entities strive to meet DORA's standards, we anticipate a surge in the adoption of sophisticated cybersecurity practices, processes, and solutions aimed at bolstering resilience and safeguarding operations against evolving threats.

Practical Steps Towards Compliance

Here are practical steps for financial institutions embarking on their path to DORA compliance:

  • Conduct a gap analysis: Evaluate current cybersecurity and operational resilience practices against DORA’s requirements. Identify gaps and prioritize areas needing improvement.
  • Strengthen ICT risk management: Develop robust policies and procedures for ICT risk management. This includes thorough assessment, mitigation, and monitoring of ICT-related risks.
  • Foster a culture of resilience: Implement training and awareness programs across the organization. Educate employees about their roles in maintaining operational resilience and promoting a security-conscious culture.
  • Enhance incident response plans: Review and update incident response and business continuity plans to align with DORA’s standards. Ensure these plans are comprehensive, clearly defining roles and responsibilities, and include timely reporting of cyber incidents as required by DORA.

These steps lay a foundation for financial institutions to proactively address DORA’s compliance requirements while strengthening their overall cybersecurity posture and operational resilience.

About Ardent Privacy

Ardent’s mission is to help enterprises implement meaningful security and privacy programs aligned to their business mission, building trust and protecting data assets. Ardent’s technology “TurtleShield” is a holistic software platform that empowers enterprise security, legal, and data teams to implement and manage data privacy within the organizations with rapid data asset visibility and actions to enable privacy compliance, govern AI risk, meaningful data protection, and reduce cost of compliance and data breaches. Our unique and patented ML/AI-powered technology helps organizations comply with evolving privacy and AI regulations and accelerates adoption of AI technologies. Ardent offers a low code platform to automate Privacy & AI governance, rapid discovery of data assets and consent management with regional focus for global regulations.