03.01.2024
Resilience in the financial sector - DORA
We have all the relevant information for affected companies:
DORA is a European Union (EU) regulation that aims to create a binding, comprehensive framework for risk management and information and communication technology (ICT) resilience for the EU financial sector. DORA was published on 16 January 2023 and has an implementation period of two years.
Who is affected by DORA?
DORA will apply to more than 20,000 financial organisations that must comply with specified standards to prevent and limit the impact of ICT-related risks. The regulation must be implemented by 17 January 2025.
Affected companies are financial institutions and ICT third-party service providers operating in the European Union:
- Banks
- Credit and payment institutions
- Insurance companies
- Securities exchanges
- Trading platforms and
- Providers of digital services
What is the aim of DORA?
DORA aims to increase the resilience of the financial sector to cyber threats and business disruptions and aims to create a comprehensive and overarching framework for digital operational resilience with rules for all regulated financial institutions.
It primarily addresses risks in the area of ICT systems and operations, cybersecurity, business interruption, IT incidents and risks of critical third-party service providers.
What does DORA require in terms of content?
Regarding DORA itself: the requirements of DORA are divided into chapters (pillars), and these in turn are divided into articles.
This facilitates the internal assignment and naming of an internal workstream with the implementation steps:
- GAP assessment and readiness audit (conducting the necessary GAP analyses and ownership for implementation)
- Development of an implementation plan (measures, milestones and prioritisation)
- Improvement of policies and procedures (harmonisation with DORA)
- Training and awareness
- Monitoring (regular assessment of the effectiveness of measures, monitoring) and continuous improvement
Pillars/chapter overview
An overview of the pillars/chapters resulting from DORA:
| Pillar 1 | ICT risk management (Articles 5-16) | The governance and control of top management with regard to its active role in the governance of the ICT risk management and cyber risk framework. A set of requirements and key principles for the ICT risk framework. |
| Pillar 2 | ICT Incident Reporting (Articles 17-23) | Standardisation of reporting and extension of reporting obligations. Financial organisations must have an ICT-related incident management process in place, including the reporting of serious security incidents to EIOPA. |
| Pillar 3 | Digital Operational Resilience Testing (Articles 24-27) | Financial firms must perform basic and advanced testing (TLPT – Thread-Led Pentration Tests: simulating a hacker attack through ethical hacking) and must implement a robust and comprehensive digital operational resilience testing programme. |
| Pillar 4 | Managing of 3rd Party Risk (Articles 28-44) | Financial organisations must manage third party ICT risk as an integral part of their ICT risk management framework. Establish principles-based rules for the monitoring of third party risk, define contractual provisions and create an overview framework for critical ICT TPPs (Third Party Providers) |
| Pillar 5 | Information Sharing Arrangements (Article 45) | Financial entities shall share information and intelligence on cyber threats with each other |
DORA Level 2 Regulatory Technical Standards (L2 RTS)
The first batch of L2 RTS was published on 17 January 2023.
This includes:
- ICT risk management framework (Art. 15, 16): Risk management tools, methods, processes and strategies, proportionality and risk-based approach, flexibility in implementation, reporting on the risk management framework, vulnerability reporting and risk management framework in numerous functions.
- Incidents related to ICT (Art. 18.3): Classification of ICT incidents with criteria such as reputational impact, duration, service outage and transactions affected
- Third party ICT services (Art. 28.9, 28.10): Details on the content of policies relating to contractual arrangements and the types of information to be included in the TPPs’ ICT services information register
The second batch of the L2 RTS was published on 10 December 2023 and is open for consultation until 4 March 2024.
Other relevant laws and guidelines
In the current context of relevant laws and guidelines for information security, we would also like to refer you to the CIS article “Significant legal advances for cyber security in 2024“, which provides an overview of relevant regulations such as the NIS 2 (Network and Information Security Directive 2), the Cyber Resilience Act (CRA), the Articifical Intelligence (AI) Act, TISAX (Trusted Information Security Assessment Exchange) and DORA (Digital Operational Resilience Act).
Contact persons
Margit Mann, MSc.
As manager of the Business Resilience, BCM division of a large insurance company in Austria, she knows the importance of the interaction of management systems, the interface topics to ISO 22301 and the adaptation of new guidelines and topics. Her personal motto: Continuous improvement as the path to success.
Lea Grösser, MA
BCM Officer and part of the project team for the implementation of DORA at Bank Gutmann AG. As a graduate of the Integrated Risk Management programme, she has been working in risk management at Bank Gutmann AG since 2020.
More news
