The Regulation (EU) 2022/2554 on Digital Operational Resilience for the Financial Sector (aka Digital Operational Resilience Act - DORA) has been adopted by EU in November 2022. Targeting any financial entity within EU, as well as critical providers of ICT services to financial entities, it aims to create a harmonized regulatory framework on digital operational resilience. To achieve this, the practice of ICT risk management is brought to the foreground, along with requirements on operational resilience testing and indentification, handling, and notification of operational resilience incidents.
The National Competent Authorities of Member States will need to enforce the regulation and supervise compliance, with the power to impose administrative penalties on members of the management body of the non-conformant financial entity.
All EU-based financial entities and providers of critical ICT services to financial entities:
| Financial Entities | ICT Service Providers |
|---|---|
| BFSI sector entities | Cloud Service Providers (CSPs) |
| Brokers | Software Providers |
| Investment firms | Critical ISVs |
| Credit Institutions | Fraud Management Providers |
| Managed Security Service Provides (MSSPs) | |
| Payment Solutions Providers |
Therefore, in case your organization falls under one of the above categories, compliance with DORA will be required.
SpearIT can support and guide your organisation throughout the proactive steps towards compliance with DORA. Our experience in compliance projects with both types of entities, ensures cost-effective and practical compliance:
While it is true that financial entities do take measures to manage risks, not all entities follow an ICT-specialized approach to risk management. Thus, a gap analysis is performed as the initial step to determine the current state of your organization's readiness against DORA requirements.
The identified gaps provide the primary road map towards DORA compliance, taking into account the specific provisions required, according to your organization's type (financial entity or critical ICT provider).
SpearIT can assist in developing a comprehensive ICT Risk Management Framework (ICT-RMF), as required by DORA, incroporating KPIs and risk metrics. Furthermore, our cybersecurity and risk management experts can assist in:
DORA raises the bar of incident classification, notification and reporting. SpearIT can assist in developing an appropriate incident management framework, capable of providing a process to:
DORA establishes the concept of digital operational resilience testing (ORT). It foresees a comprehensive resilience teting programme with a range of assessments and methodologies to be performed on an annual basis.
SpearIT, with a team of hihgly qualified and certified offensive security professionals, can provide these types of assessments, such as vulnerability assessments, penetration testing and red team attacks (threat-led penetration testing).
It should be restated that DORA considers risk management practices of high importance. Apart from the internal, ICT risk management framework, it also requires that financial entities effectively manage third-party risks. To achieve this, financial entites shall:
Especially for critical ICT third-party providers, DORA requires the alignment with the Union Oversight Framework: a supervision and collaboration regime between the Lead Overseer and the critical ICT third-party service providers, offering services to financial entities which may affect the supply of financial services.
An overlap of NIS2 Directive with requirements set by other, sector-specific regulations, such as DORA, is observed. As a general rule, NIS2 shall not apply to entities regulated by sector-specific legislation, if the requirements set by the latter are at least equivalent in effect to those of NIS2 Directive.
However, at the current, early state of DORA enforcement, SpearIT recommends to plan for NIS2 & DORA compliance, jointly. Once both legislations become final and related guidelines are published, a subsequent gap analysis can be performed to ensure proper compliance and alignment.
Act ahead of time. Connect with a DORA compliance expert.
START HERE
