Exploring DORA for financial services: How to effectively navigate the jungle of regulatory concerns

In response to the rapidly increasing integration of technology in financial firms, and with cyber-attacks becoming more frequent, targeted, and complex than ever, an important regulation called DORA is now being implemented by the European Union.

Although it came into force on 16 January 2023, it will be fully applicable from 17 January 2025, and will be used to enforce effective cyber risk management and drive operational resilience. It applies to over 220,000 financial entities in the EU, including but not limited to banks, investment firms, insurance undertakings and intermediaries, crypto asset providers, data reporting providers and cloud service providers. While sharing similar goals with other regulations affecting the sector such as the FCA operational resilience policy or GDPR, the latest framework particularly focuses on Information and Communication Technology (ICT) risk. As an EU regulation, UK firms conducting business in Europe will need to comply with its requirements. Affected organisations will need to adapt by managing their cyber risk and only interacting with third-party vendors that offer "high, appropriate, and the latest information security standards."

But what exactly does this new regulation mean for financial firms? And, if your organisation is affected, how can you ensure you have the right defences in place to ease your compliance with DORA? We answer all of these questions and more in our latest blog. So read on!

So what is DORA?

This isn’t the explorer you’re looking for…DORA is not the adorable quest-solving heroine sporting her iconic bob, but the Digital Operational Resilience Act, which comes into full effect in January 2025, is a new framework proposed by the EU to help prevent and mitigate cyber threats in the EU financial sector. DORA seeks to address potential risks posed by the sector’s reliance on Information and Communication Technology (ICT) third-party providers (TPPs), and sets uniform requirements for financial organisations on ICT risk-management, incident reporting, operational resilience testing, and third-party risk monitoring. And, as it comes into effect in January 2025, it’s important for financial organisations to prepare for compliance before the deadline. In order to not get lost in the jungles of regulatory changes, KYND helps you explore exactly what DORA compliance involves.

Understanding the five pillars of DORA

DORA separates digital operational resilience into five areas: 1) risk management, 2) incident reporting, 3) digital operational resilience testing, 4) third-party risk management, and 5) information and intelligence sharing. Let’s break down what these mean in a nutshell:

1. Risk Management: This pillar requires an organisation’s management body to have implemented measures to ensure that their ICT risk management framework is well-documented, outlining strategies, policies and procedures to secure ICT assets and the offline infrastructure supporting them, as well as periodically reviewing and auditing them.

2. Incident Reporting: DORA introduces fresh obligations for preparing, responding to, and reporting any ICT-related incidents or threats that have occurred. In July 2024, even further policy mandates were introduced around Regulatory Technical Standards (RTS) and Implementing Technical Standards (ITS), including the number of users impacted, duration, geographic spread, data loss, impact to ICT systems, and criticality of services affected. Major incidents must be reported within the same business day and follow-up reporting will be due after a week.

3. Digital Operational Resilience Testing: Organisations are required to run comprehensive risk-based tests at least once a year. In all cases external testing is necessary to assess readiness for handling ICT-related incidents and identifying weaknesses or gaps in digital operational resilience. As well as annual testing, financial entities will also be required to organise threat-led, live penetration testing every three years (known as a red-team type exercise) that must be performed by independent testers with approval from a DORA regulator to guarantee reliable test outcomes. The preparation for the process can be time-consuming, and organisations are strongly advised to commence their preparations as early as possible to ensure sufficient time for regulatory approval.

4. Third-Party Risk Management: DORA prevents systemic economic disruption by ensuring that financial entities have a robust, mature third-party risk management process in place; this involves an information register that includes details of all ICT third-party providers, the services they provide, and the functions they support. Additionally, an annual report on any changes made to this register is required. DORA also mandates annual assessments for critical providers to verify their compliance. Failure to demonstrate this through standard checks will lead to legal and financial consequences.

5. Information and Intelligence Sharing: DORA supports a more resilient environment for financial firms across Europe by promoting the sharing of critical information on threats and vulnerabilities across financial entities, regulatory authorities and technology providers. This aims to prevent the spread of cybercrime before a major economic impact occurs, as well as support and protect organisations from operational dangers.

Don't mess with DORA!

Preparations for compliance represent a significant and time-consuming task. But what are the consequences of non-compliance with DORA? The new regulation in the realm of financial services places the ultimate responsibility on board members and directors to implement the right measures to prevent and mitigate cyber threats. If an organisation fails to comply with DORA, these individuals will be held accountable and face significant repercussions such as reputational damage, shareholder litigation, regulatory fines, and even criminal charges – DORA requires Member States to provide for individual civil liability for board members, and it also leaves open the possibility for Member States to establish criminal liability. Despite the challenge, your organisation can leverage this opportunity to strengthen its cybersecurity posture, improve third-party risk management and enhance incident response capabilities, all while solidifying the trust of stakeholders.

What can financial organisations do to prepare?

There are several key steps you and your financial organisation can take to better prepare for the Digital Operational Resilience Act and ensure compliance. These steps include:

1. Establishing an incident reporting method in line with DORA's requirements within your organisation:

• Implement a clear and structured incident reporting process that outlines the criteria for reporting operational disruptions or cyber incidents.

• Define roles and responsibilities within your organisation for incident reporting and establish communication channels to promptly notify relevant stakeholders, including regulators if required.

• Ensure that incident reports are documented, analysed, and used to improve incident response and recovery procedures.

2. Enhancing your corporate governance and compliance:

• Appoint dedicated teams or individuals responsible for overseeing operational resilience and compliance with DORA requirements.

• Establish effective communication channels with regulators to stay informed about updates, guidelines, and reporting obligations.

• Regularly review and update internal policies and procedures to align with evolving regulatory requirements.

• Engage in regular audits and assessments to ensure ongoing compliance with DORA's provisions.

3. Strengthening your organisation’s technology infrastructure and cybersecurity measures:

• Invest in robust technology infrastructure to support the organisation's digital operations and ensure scalability, reliability, and resilience.

• Implement strong cybersecurity measures, including firewalls, encryption, multi-factor authentication, and intrusion detection systems.

• Regularly update software, operating systems, and security patches to address known vulnerabilities and protect against emerging threats.

• Conduct regular vulnerability assessments to identify and address potential weaknesses in the digital infrastructure. If you haven’t already heard, KYND can help you understand and manage your organisation’s exposure easily and effectively. We dive into the details below.