On 27 December 2022, the Digital Operational Resilience ACT (DORA) was published in the Official Journal of the EU. The regulation’s primary objectives are to comprehensively address the management of ICT risks, with the goal of establishing a stronger and more resilient framework for providing digital capabilities within the financial sector, and to streamline the existing ICT risk management regulations in various EU member states.
DORA aims to ensure that financial institutions effectively manage the risks associated with their growing dependence on ICT systems and third-parties for critical operations. This risk mitigation involves robust practices in risk management, incident reporting, digital operational resilience testing, and third-party risk management.
DORA goes beyond providing general guidelines, as it introduces highly detailed and precise requirements. It consists of criteria, templates, and instructions that will have a substantial impact on how financial institutions manage ICT-related risks.
DORA introduces requirements across five pillars:
- ICT Risk Management
- ICT Incident Reporting
- Digital Operational Resilience Testing
- ICT Third-party Risk Management
- Information and Intelligence Sharing
Who will be impacted by DORA?
DORA primarily impacts financial entities and institutions within the EU. This includes credit institutions, banks, insurance companies, investment firms, and other financial market participants operating in the EU.
DORA also applies to some entities that are typically excluded from financial regulations. ICT third-party providers to the financial sector such as cloud providers, software providers, and data centres must also follow DORA requirements.
When will DORA be enforced?
DORA became effective on January 16, 2023, and financial institutions are anticipated to achieve compliance with the regulation by January 2025, following a two-year implementation period.
How can organisations ensure compliance?
- Comprehensive Assessment of ICT Risks: Conduct a thorough assessment of ICT-related risks within your organisation. This includes identifying critical ICT systems, data, vulnerabilities. Understanding your risk landscape is foundational to compliance.
- Documentation & Governance: Establish robust governance structures and processes for monitoring and managing ICT-related incidents and resilience. Maintain detailed documentation of ICT systems, processes, and risk management procedures. Documentation is essential for compliance and reporting.
- Incident Response Planning: Develop a comprehensive incident response plan that outlines how your organisation will handle ICT incidents, including communication, remediation, and reporting protocols. Ensure your team is prepared to respond effectively to disruptions.
- Regular Testing & Simulation: Regularly test the resilience of your ICT systems through various scenarios, including simulated incidents. This helps to ensure that your organisation can effectively respond to disruptions and meets the requirements of DORA.
- Assemble a Cross-Functional Team: Bringing together a cross-functional team of experts in risk management, business continuity, cyber security, and governance will provide a good understanding of the business as it stands today and will lead the implementation process effectively.
- Training & Awareness: Provide training and awareness programs for your staff to ensure they understand DORA requirements and how they relate to their roles and responsibilities within the organisation. Compliance efforts are only as strong as the awareness and actions of your workforce.
Conclusion
By assessing potential risks, establishing governance, planning for unexpected incidents, testing resilience, and ensuring your team is up to speed, your organisation can put itself in a better position to meet the regulations and strengthen its operational resilience.
But here's the catch: DORA is complex and always evolving. So, this isn't a one-time deal, your compliance efforts should be ongoing. It’s important to stay vigilant, keep an eye out for updates and changes to DORA, and be ready to adjust your compliance strategy as needed.
The reassuring news is that you still have plenty of time to get things in order before the January 2025 deadline.
Contact us today to discover how we can enhance your operational resilience by immersing key personnel in role-play scenarios, empowering them to effectively respond to security incidents and safeguard critical systems against potential threats.
