DORA Regulation
DORA — Digital Operational Resilience Act, the EU's new regulatory framework for the financial sector. What does the new law mean for the financial sector? Which ones are covered? And what is required to comply with the requirements of the law? We'll figure that out in this blog post.
Background to the new DORA Regulation
Cyber attacks and IT related risks are becoming an increasing threat to the financial sector, which has led the EU to now impose higher standards to prevent and reduce these cyber threats.
The European Commission published its proposal for a new regulation, the so-called DORA Regulation, on 24 September 2020. The European Parliament approved DORA in November 2022 and the Council of Ministers gave its approval in January the following year.
What is DORA?
DORA stands for Digital Operational Resilience Act and is a Digital Operational Resilience Regulation for the financial sector. The purpose of DORA is to ensure that participants in the financial sector do what is necessary to, among other things, establish operations in the event of serious operational disruptions and to counter cyber attacks and other IT related risks.
The proposal consists of requirements for financial sector actors to be prepared against information and communication (ICT) related disruptions and threats. This includes problems and risks related to information and communication technologies, such as data breaches, system failures and cyber attacks. Therefore, there are regulations on governance, risk management, reporting and testing.
Among other things, the regulation requires financial firms to regularly carry out various tests regarding their digital resilience. Activities shall identify and mitigate potential weaknesses or vulnerabilities by performing basic tests of their ICT devices and tools. They shall document and review ICT-related risks at least once a year.
Central areas in DORA
DORA includes five core areas:
1. ICT risk management
— ICT risk management framework
2. ICT-related incident reporting
— Management, classification and reporting
3. Testing Digital Operational Resilience
— Digital resilience testing program
4. Third-party ICT risk management
— Risk management of third party risk
5. Exchange of information
— Cyberthreats
High demands on actors
The regulation includes, among other things, higher requirements for:
- Management of risks related to ICT (information and communication technologies)
- Classification and reporting of ICT-related incidents
- Testing the digital operational resilience
- Third-party risk management
Who is covered by DORA?
Those that will be covered by the new EU regulation include banks and other credit institutions, insurance companies, investment firms and other financial sector companies that include financial services. In addition to these, critical ICT providers including cloud service providers are also covered.
Those covered are:
- Credit institutions
- Payment institutions
- Providers of account information services
- Electronic Money Institute
- Investment firms
- Crypto Asset Service Providers
- Central Securities Depositories
- Central counterparties
- Trading places
- Transaction register
- Alternative Investment Fund Managers
- Management Company
- Data reporting service providers
- Insurance and reinsurance companies.
- Insurance intermediaries
- Institutions for occupational pensions
- Credit rating agencies
- Critical Benchmark Administrators
- Crowdfunding service providers
- Securitisation Register
- Third-party ICT service providers
When does DORA come into effect?
DORA will apply on 17 January 2025, which means it is high time for those covered to start reviewing what you need to do to comply with the new regulation.
Is your organization ready for DORA?
With our help, we carry out a GAP analysis based on the requirements of DORA. We will find out where your vulnerabilities lie and what steps are needed to comply with the new regulation.