Exploring DORA: Understanding the Impact of the EU’s Digital Operation Resilience Act

Requirements:

DORA requires that financial entities develop a comprehensive ICT risk management framework that identifies, assesses, and mitigates ICT risks. The framework should be integrated into the broader risk management system and governance policies. Some key aspects to note:

• The ICT risk management framework shall include, at the very least, strategies, policies, procedures, ICT protocols, and tools deemed necessary to sufficiently protect all information and ICT assets. These include computer software, hardware, servers, and relevant physical components and infrastructures such as data centers.
• DORA also requires that the management body of the financial entity define, approve, oversee, and be held responsible for the implementation of the ICT risk management framework.
• The management body bears the ultimate responsibility for managing ICT risk and must set “clear roles and responsibilities” for all ICT-related functions and establish appropriate governance arrangements.
• Covered entities must, among other critical steps, conduct continuous risk assessments on their ICT systems, document and classify cyber threats, and document their steps to mitigate identified risks.
• Part of the risk assessment includes business impact analyses to assess how specific scenarios and severe disruptions might affect the businesses. These analyses must then be used to set levels of risk tolerance and shape the design of their ICT infrastructure.
• Financial entities also need to establish business continuity and disaster recovery plans for multiple risk scenarios, including natural disasters and cyberattacks. Data backup, recovery measures, and system restoration processes must be included as well, along with plans for communicating with affected clients and the authorities.

How to Meet Them:

• Conduct a Gap Analysis: Financial entities must evaluate current ICT frameworks to identify compliance gaps with DORA’s requirements.
• Develop and Implement Frameworks: Establish a documented ICT risk management framework that outlines roles, responsibilities, and processes for ongoing risk assessment and mitigation.
• Provide Regular Updates: Continuously update governance policies to reflect changes in the ICT landscape and emerging threats. 

DORA also requires the covered entities to establish ICT incident management and reporting systems for monitoring, managing, recording, classifying, and reporting ICT-related incidents.

The ICT-related incident management requires covered entities to have the following:

• Early warning indicators.
• Procedures to identify, track, log, categorize, and classify ICT-related incidents according to their priority and severity.
• Assign roles and responsibilities that need to be activated in the event of an ICT-related incident, based on types and scenarios.
• Determine plans for communicating the incident to staff, external stakeholders, and the media, as well as notifications to clients, how to handle complaints, and how information is passed to counterparts.
• Ensure that at least major ICT incidents are reported to relevant senior management and the management body, explaining the impact, response, and additional control to be established.
• Establish response procedures to mitigate impact and ensure services become operational and secure in a timely manner.

How to Meet Them:

• Establish Reporting Procedures: Implement standardized procedures for detecting, managing, and reporting ICT incidents.
• Use Standardized Formats: Develop templates for incident reports to ensure consistency and compliance with regulatory standards.
• Timely Reporting: Ensure significant incidents are reported to national competent authorities within prescribed timelines.

Requirements:

Covered entities must regularly test their ICT systems to evaluate the strength of the protection systems in place and to identify vulnerabilities. The results of these tests, along with plans for addressing any discovered weaknesses, must be reported and validated by relevant authorities.

When conducting the digital operational resilience testing program, financial entities need to follow a “risk-based approach,” which considers the evolving landscape of ICT risk and other specific financial security risks. They also need to establish procedures and policies to prioritize, classify, and remedy all issues discovered during the testing.

Other key things to note:

• Financial entities need to carry out appropriate tests on all ICT systems and applications supporting critical functions at least yearly.
• The tests include vulnerability assessments and scans, open-source analyses, network security assessments, gap analyses, physical security reviews, questionnaires and scanning software solutions, scenario-based tests, and penetration testing.
• Financial entities deemed critical for the financial system will also need to undergo threat-led penetration testing (TLPT) every three years. Critical ICT providers for that entity also need to participate in these penetration tests.

How to Meet Them:

• Annual Testing: Conduct annual resilience and vulnerability tests on all critical ICT systems.
• Threat-Led Penetration Testing (TLPT): If applicable, perform TLPT every three years based on the firm’s risk profile.
• Document Results: Maintain records of testing outcomes and remediation efforts to demonstrate compliance.

Requirements:

While not mandatory, DORA encourages entities to participate in sharing threat intelligence among other covered entities, such as indicators of compromise, tactics, techniques, procedures, and cybersecurity alerts.

This is with the aim of enhancing the overall digital operational resilience of the sector, along with raising awareness of cyber threats, limiting the spread of these threats, and improving threat detection.

The information sharing must take place within trusted communities of financial entities. The information shared this way must still be protected under relevant guidelines such as the GDPR.

How to Meet Them:

• Participate in Information Sharing Networks: Engage in voluntary threat intelligence sharing initiatives while ensuring compliance with data protection regulations like GDPR.
• Develop Incident Learning Processes: Create processes to analyze incidents and share insights with peers to improve collective resilience.

Requirements:

DORA not only applies to financial entities but also to third-party ICT providers servicing the financial sector. Financial entities are required to manage ICT third-party risks as an integral component within their risk management framework. This includes multiple steps:

• Financial entities must adopt and regularly review a strategy on ICT third-party risk, which must include a policy on the use of ICT services supporting critical or important functions provided by the third-party provider.
• Financial entities are also required to maintain and update a register of information to all contractual arrangements on the use of ICT services provided by the third-party provider, on top of reporting (at least yearly) to authorities on new arrangements.
• When outsourcing critical functions, financial entities must negotiate specific contractual arrangements, such as full-service level descriptions, notice periods and reporting obligations, requirements to implement and test contingency plans and security measures, exit strategies, and more.
• Third-party providers that cannot meet these requirements cannot be allowed to contract. The authorities are also empowered to suspend or terminate contacts that don’t comply.
• Third-party providers deemed critical will be subject to oversight from relevant ESAs. Lead overseers will enforce DORA requirements on critical providers and forbid them from entering contracts that fail to comply.

How to Meet Them:  

• Due Diligence and Monitoring: Conduct thorough due diligence on third-party providers and continuously monitor their compliance with DORA standards. 

• Contractual Obligations: Include DORA compliance clauses in contracts with third-party providers, specifying technical standards, audits, and exit strategies. 

• Oversight Frameworks: For critical providers, ensure they are subject to oversight by European Supervisory Authorities (ESAs) and comply with additional regulatory requirements.