EU Digital Operational Resilience Act (DORA)

The financial sector's reliance on technology and ICT providers poses significant risks, particularly vulnerabilities to cyberattacks. To address these challenges, the EU introduced the Digital Operational Resilience Act (DORA), creating a framework for effective risk management, cybersecurity, and third-party risk management, ensuring the uninterrupted delivery of financial services. While general rules exist, DORA specifically enhances resilience requirements for all EU financial entities. The Network and Information Systems Directive 2 (NIS2), partially applied within finance, aims at heightened cybersecurity but lacks consistent implementation across EU member states, prompting the development of the DORA to harmonize resilience requirements. DORA applies to a range of financial entities, including banks and insurance companies, and introduces standardized requirements for assessing and reporting ICT risks.

In essence, DORA outlines principles and mandates for ICT risk management, incident reporting, resilience testing, third-party risk management, and cyber threat intelligence sharing, focusing on integrating resilience into operational frameworks. The regulation stipulates the establishment of governance and control frameworks, comprehensive risk management systems, updated ICT tools, and detailed incident classifications, among other requirements. To comply, organizations must implement processes for risk management, resilience testing, and threat intelligence sharing. The legislation also calls for continuous monitoring of ICT systems, regular security assessments, and heightened cooperation with regulatory authorities. DORA, in alignment with international efforts, aims to unify ICT risk regulations across the EU, fostering an environment where financial entities can maintain operational continuity despite cyber disruptions.

• The Digital Operational Resilience Act (DORA) came into effect on 17 January 2023 and enforced starting 17 January 2025.
• DORA applies to a variety of financial entities including banks, insurance companies, and cloud service providers.
• The DORA aims to streamline and enhance existing cybersecurity regulations while adding new requirements.
• Current rules for EU financial entities failed to harmonize ICT risk regulations, necessitating DORA.
• DORA stipulates that financial entities must report all major ICT-related incidents to relevant authorities.
• The NIS2 Directive does not comprehensively cover the financial sector.
• Advanced resilience testing (threat-led penetration testing) for critical ICT tools and systems is required at least every three years.
• Financial entities are required to maintain a register of all contractual arrangements with third-party ICT providers.
• Financial entities must share cyber threat information within trusted communities.
• DORA mandates that financial entities maintain high standards of data availability, authenticity, integrity, and confidentiality.

• "Digital resilience of financial entities is addressed and integrated into their broader operational frameworks."
• "The legislation is a part of international efforts to enhance digital resilience, set standards, and coordinate regulatory work."
• "EU legislators believe that a dedicated framework to promote operational resilience in the financial sector was necessary."
• "Information sharing is a good policy for all organizations."
• "DORA requires financial entities to build, assure, and review their operational integrity and reliability."
• "Adopt a comprehensive digital operational resilience testing programme as part of an ICT risk-management framework.”
• "The concept of a security fabric supports a consistent approach to security and compliance."
• "Financial entities must classify ICT incidents and determine their impact.”
• "The regulation introduces an EU-wide oversight framework for critical third-party ICT providers."
• "Organizations that need to comply should not delay in taking action to ensure that they have enough time to identify and carry out the work that needs to be done to update current security technologies, policies, and procedures."