The European Union’s Digital Operational Resilience Act (DORA) consolidates digital security standards for financial entities in its member territories. These are primarily exemplified through the framework’s key initiatives, also known as the 5 pillars of DORA:
- ICT Risk Management
- Incident Reporting
- Digital Operational Resilience Testing
- Management of Third-Party Risk
- Information Sharing
DORA complements the reinforced Network and Information Security 2 (NIS2) Directive. However, unlike NIS2, DORA is an enforceable regulation similar to the EU’s General Data Protection Regulation (GDPR). If you’re working within the IT and financial sectors, here’s everything you need to know about DORA cybersecurity requirements.
The 5 pillars of DORA regulation
Financial institutions are known for their complex IT infrastructures. These technologies enable organizations to optimize performance and security measures in new ways but also require more robust risk management solutions.
DORA aims to address these gaps by introducing a series of requirements that raise the level of information and communication technology (ICT) standards across the financial sector. On balance, DORA’s philosophy and vision are encapsulated in the following pillars:
-
ICT risk management
IT risk management is the cornerstone of DORA’s framework. It encompasses the strategies, policies, and tools necessary to protect data and assets against significant ICT challenges.
This pillar ensures financial institutions and various stakeholders promptly and accurately monitor, assess, and contain ICT-related vulnerabilities. It also covers how they report and respond to such incidents. Financial companies and their associated third-party service providers must be prepared for regular security audits and assessments.
IT officers must develop a comprehensive ICT risk management framework to meet DORA’s compliance requirements. This can mean leveraging existing protocols and redefining certain objectives and roles in the organization. A thorough action plan should feature a proactive and consistent approach to risk management.
-
ICT-related incident reporting
Under DORA, organizations must work with relevant authorities to address major ICT-based incidents.
Incidents must also be immediately classified based on their impact and potential to disrupt service levels. They must also be reported to the relevant authorities using DORA’s strict notification timelines and standard templates.
Given the added emphasis on ICT incident reporting, IT officers should look into strengthening internal review and documentation procedures. One way to achieve this is through automation.
Automation can implement a more comprehensive and connected risk management plan. For starters, advanced monitoring software can help organizations stay ahead of potential issues with real-time monitoring, threat detection, and response. At the same time, this modern approach can reinforce backup and recovery practices.
-
Digital operational resilience testing
DORA also strongly advocates for regular testing of digital resilience measures. In other words, organizations are expected to analyze the impact of specific scenarios and significant disruptions to their business. Relative to this, large institutions may be required to follow more comprehensive and frequent testing protocols.
Some proactive measures that IT operatives can organize include network security tests and various vulnerability assessments. You should also arrange regular threat assessments to help identify gaps in the process and reinforce existing security schemes and remediation plans. Financial entities must also include ICT third parties in cybersecurity resilience training programs as part of the requirements.
-
Management of ICT third-party risk
One of the crucial items in DORA’s framework is about managing third-party risks and compliance.
From a broader perspective, it actualizes the extended responsibility of financial organizations in member territories to adhere to the EU ICT provisions and laws.
By this guideline, financial entities must ensure that contracts with ICT third-party service providers, even those outside the EU, clearly and accurately define the obligations and rights of both parties. They must also monitor and regularly assess third-party compliance.
Financial companies cannot heavily depend on a single provider for their core functions and critical IT infrastructures. Hence, they must take the initiative to diversify IT infrastructures and develop strict protocols to maintain compliance across the board.
On that note, ICT third-party service providers of core or crucial operations will also be subject to direct oversight from relevant European Supervisory Authorities (ESAs).
-
Information and intelligence sharing
Institutions are also encouraged to participate in information-sharing initiatives to collectively raise the standards in the industry. Aside from enhancing the reporting process, documentation, and cross-functional collaboration within the company, ICT operatives should leverage collaboration with authorities and third-party service providers.
Implications of DORA for businesses
DORA primarily aims to enhance IT security and operational resilience in the financial sector.
The businesses that are front and center on this initiative are banking and credit institutions, investment firms, insurance companies, and payment processing service providers.
In addition, cloud service providers and data analytics companies that manage essential services for financial institutions can be classified as critical third-party providers and be subject to similar rigorous provisions and laws.
To prepare for DORA implementation, organizations must understand the scope and requirements of DORA from them and their business partners. They will also benefit from working with third-party service providers that are already observing NIS2, GDPR, and DORA guidelines.
For ICT leaders and personnel, compliance must be treated as a process rather than a project. Adjusted ICT protocols must be adaptive, especially as new information becomes available. The overall approach must be ongoing, and anyone involved should be prepared for collaboration and regular training.
Best practices for achieving DORA compliance
Diversify IT infrastructures
One way to create a robust IT infrastructure is to diversify it. There are many ways to achieve this initiative, but most companies can first look into the modernization of some components and IT automation. Remote monitoring and maintenance can do wonders for efficiency and real-time security.
Empower internal channels for cross-function training and collaboration
Gaps in ICT aren’t exclusive to the IT department. The company needs a holistic approach in order to identify vulnerabilities and reinforce protocols. Communication channels encompassing different departments and business units are important to raise organization-wide awareness and compliance.
Collaborate with external stakeholders
The 5 pillars of DORA already emphasized the importance of collaboration, and we’re doubling down here. Your organization should maintain cooperation with regulatory bodies to get the most accurate and updated interpretation of DORA. Likewise, you should hold vendors to the same standards, especially those servicing your operation’s critical sectors. Include them in ICT and DORA training where applicable.
Implement GRC in your strategy
GRC, or Governance, Risk, and Compliance, can help position the workforce to achieve DORA compliance collaboratively. At its core, the GRC framework removes traditional barriers between business units, eliminates disconnected processes and redundancies, and aligns IT with business objectives.
The GRC framework can be especially effective for meeting industry and government regulations and managing risks. For it to succeed, this initiative needs strong support from all sectors, particularly from decision-makers. Finding the right software to consolidate GRC efforts can also create unique challenges for the company.
Prepare your organization for DORA compliance
DORA is relatively new, but its provisions are mostly unified from existing IT compliance standards like GDPR and NIS2. Hence, you should leverage those resources to fortify and establish your risk management plan, IT components, and training programs. While DORA’s initiatives bring many new challenges, compliance officers and IT professionals should also see an opportunity to harmonize their ITC strategy and move decision-makers to upgrade IT infrastructures with both immediate and long-term benefits and ramifications at hand.
