DORA and Your Company: Everything You Need to Know About the New Legislation
Imagine a future where the financial sector is safe from cyber threats and breaches. Customer data is carefully protected, and the entire industry operates with unshakeable resilience. DORA, with its comprehensive framework of standards and processes, strives to turn this vision into a reality. It aims to ensure a consistent approach to digital resilience and to give the financial sector the best possible protection.
In this article, we bring you more information about DORA. You will learn what exactly DORA entails, what its objectives are, the possible consequences of non-compliance, the key requirements it involves, and, last but not least, which sectors are affected by the regulation.
Karolína Kubínová works at axelum as a Security Analyst specializing in preparing companies for security certifications, conducting internal audits and improving security processes (mainly based on ISO 27K, KB Act and best practices). She also works on social engineering, especially phishing and vishing campaigns, and security awareness.
What does DORA actually mean?
DORA, or the Digital Operational Resilience Act, is a new piece of legislation from the European Commission. Its purpose is to increase cyber security and operational resilience in financial services in the European Union. The regulation responds to the growing threat of cyber-attacks, data leaks, and other digital security risks facing the industry.
The DORA initiative seeks to create a unified approach to digital resilience in the financial sector through a comprehensive framework of standards and processes. At the same time, it strengthens the resilience of digital operations in the industry through increased supervisory powers and direct control capabilities.
Why is DORA important?
And what happens if you do not comply with DORA? In the event of non-compliance, the authority can impose daily fines for up to 6 months. The daily rate is 1 % of the average daily worldwide turnover of the provider.
When will DORA become effective?
DORA entered into force on January 16, 2023. However, please note in your calendar that it will not become effective until January 17, 2025. We encourage you to act as soon as possible and start preparing to meet this deadline. At axelum, we can help you with this!
What are the main requirements of DORA?
Governance: DORA highlights the importance of the direct involvement of the governing body in the ICT risk management process, as well as in regular training. In addition, a security awareness programme should be fully implemented for all employees.
Risk Management: The Regulation requires an ICT risk management framework, including a digital operational resilience plan, to be establishing and maintaining.
Intelligence Sharing: DORA promotes the sharing of threat intelligence in the financial industry, recognising that many cyber threat actors target multiple organisations simultaneously. By facilitating intelligence sharing, DORA enhances the industry's awareness of ongoing cyber threats and helps improve its preparedness to address them.
Incident Reporting: DORA requires the establishment of a process for tracking, recording, and classifying incidents to enable firms to monitor and respond to potential cyber threats and other operational disruptions effectively. To promote transparency and accountability, DORA mandates the reporting of serious incidents to supervisory authorities and, in certain cases, to clients to ensure that all relevant parties are aware of potential risks and can take appropriate measures to address them.
Resilience Testing: DORA requires firms to test assets and functions regularly to identify potential weaknesses and gaps to ensure they can respond effectively to potential cyber threats and other disruptions. To enhance the resilience of larger and more significant entities, DORA mandates regular advanced testing (not applicable to micro-businesses).
Audit Access: DORA enables regulators (and financial institutions in the case of suppliers) to conduct audits throughout the financial industry's supply chain, promoting compliance with regulatory requirements. As a result, organisations must be able to generate reports on demand to facilitate audit access and ensure compliance with the regulation.
Third Parties: DORA requires firms to establish principles for selecting third-party ICT service providers to ensure they meet appropriate standards for digital operational resilience and minimise potential risks to their operations. To promote effective oversight of third-party ICT service providers, DORA mandates the establishment of minimum requirements for relevant contractual arrangements.
What sectors are affected by DORA?
What sectors are excluded from DORA?
- Managers of alternative investment funds as referred to in Article 3(2) of Directive 2011/61/EU
- Insurance and reinsurance undertakings as referred to in Article 4 of Directive 2009/138/EC
- Institutions for occupational retirement provision which operate pension schemes which together do not have more than 15 members in total
- Natural or legal persons exempted pursuant to Articles 2 and 3 of Directive 2014/65/EU
- Insurance intermediaries, reinsurance intermediaries, and ancillary insurance intermediaries, which are microenterprises or small or medium-sized enterprises
- Post office giro institutions as referred to in Article 2(5), point (3), of Directive 2013/36/EU
Adapt to DORA Easily with Our Experts
Count on us as your trusted guide in navigating the changes that the DORA regulations bring. We empower your financial business with deep expertise and knowledge of the new regulation, ensuring you can overcome challenges and seize opportunities.
Read More
Right in Your Inbox
Stay up to date and get the newsletter. Every month, you can look forward to exclusive educational content and news from the infosec world.
