Preparing for DORA, the Digital Operational Resilience Act

The Digital Operational Resilience Act (DORA) is a transformative regulatory framework introduced by the European Union. It aims to bolster the digital resilience of financial institutions while addressing Information and Communications Technology (ICT) risks across the financial sector. Enacted on January 16, 2023, DORA will become fully enforceable on January 17, 2025, giving organisations a critical timeline to achieve compliance.

DORA’s overarching goal is to ensure that financial institutions can effectively withstand, respond to, and recover from ICT-related disruptions. This framework plays a vital role in safeguarding the integrity of the EU’s financial ecosystem and reducing systemic risks.

Why Was DORA Introduced?

Before DORA, financial institutions often relied on reactive approaches to manage ICT-related risks. These approaches included:

• Allocating emergency funds to address disruptions after they occurred.
• Implementing fragmented risk management strategies, which were frequently inconsistent across organisations and regions.

These reactive methods created several significant challenges:

1. Rising Incident Costs: Managing incidents after they occurred resulted in higher expenses, including fines, reputational damage, and operational downtime.
2. Inconsistent Practices: The absence of a unified framework left the financial sector vulnerable, especially given its reliance on interconnected networks and services.
3. Increased Systemic Risk: Neglecting root vulnerabilities heightened the risk of disruptions spreading across the financial system.

Consequently, DORA shifts the focus to proactive risk management, requiring organisations to adopt preventive measures and build robust resilience capabilities.

Who Does DORA Apply To?

DORA applies broadly across the financial sector, covering entities such as:

• Banks
• Investment firms
• Payment institutions
• Insurance companies
• Crypto-asset service providers

Moreover, ICT third-party providers, including cloud service providers and data centres, must also comply with DORA. This ensures the entire financial ecosystem adheres to rigorous resilience standards.

Importantly, DORA impacts over 22,000 financial entities and ICT service providers within the EU, as well as those providing critical ICT services from outside the EU. Therefore, organisations operating outside the EU must quickly evaluate whether their activities within EU jurisdictions fall under DORA’s scope.

Key Requirements

DORA is structured around five core themes, each accompanied by specific requirements:

1. ICT Risk Management (Articles 5 – 16):
   • Organisations must create a comprehensive ICT risk management framework addressing identification, protection, detection, response, and recovery.
   • Senior management must take accountability and ensure governance structures are robust.
2. ICT Incident Management, Classification, and Reporting (Articles 17 – 23):
   • Organisations are required to standardise the classification and reporting of major ICT incidents.
   • Reporting mechanisms must include anonymised EU-wide incident reporting processes.
3. Digital Operational Resilience Testing (Articles 24 – 27):
   • Regular resilience testing, including large-scale threat-led penetration tests conducted every three years by independent accredited testers, must be performed.
4. ICT Third-Party Risk Management (Articles 28 – 44):
   • Organisations must maintain a detailed register of contractual arrangements with ICT providers.
   • Pre-contract assessments, contract guidelines, termination strategies, and exit plans must also be implemented.
5. Information Sharing Arrangements (Article 45):
   • Financial entities are encouraged to share threat intelligence and collaborate to strengthen collective resilience.

Steps to Prepare for Compliance

To achieve compliance by January 17, 2025, organisations should take the following actions:

1. Conduct a Gap Analysis:
   • First, identify weaknesses in ICT risk management, incident reporting, and third-party oversight practices.
2. Develop an Implementation Plan:
   • Next, allocate resources and set clear timelines to address compliance requirements.
3. Strengthen ICT Risk Management:
   • Additionally, update policies to incorporate continuous risk assessment and deploy advanced monitoring tools.
4. Streamline Incident Reporting:
   • Furthermore, establish procedures that align with DORA’s incident classification and reporting standards.
5. Test Digital Resilience:
   • Moreover, conduct regular resilience assessments, including penetration testing, to identify and address vulnerabilities.
6. Enhance Third-Party Oversight:
   • Similarly, evaluate ICT providers for DORA compliance and implement robust contracts with termination strategies.
7. Foster Collaboration:
   • Finally, participate in information-sharing networks to remain informed about emerging threats and best practices.

Penalties for Non-Compliance

Non-compliance with DORA can result in severe penalties. National competent authorities may:

• Impose fines, including periodic payments of up to 1% of the average daily global turnover of the preceding year for up to six months until compliance is achieved.

Beyond financial penalties, organisations may face reputational damage, operational setbacks, and increased exposure to ICT disruptions.

DORA represents a critical step toward building a resilient and secure financial ecosystem. By addressing vulnerabilities and fostering collaboration, it equips financial institutions to handle modern ICT challenges effectively.

How Assure Technical Can Help

A key requirement is regular large-scale, threat-led penetration tests conducted by independently accredited testers.

At Assure Technical, we provide CREST-approved Penetration Testing services and have helped countless financial organisations safeguard their operations and maintain regulatory compliance.

We’re proud to be recognised as the most trusted cybersecurity partner in the UK, with over 250 genuine 5-star Trustpilot reviews.  We’re here to support your cybersecurity needs, keeping you ahead in an ever-evolving digital landscape. 

Get in touch with our award-winning team today to find out more about how we can help you navigate your cyber compliance requirements with ease.