The European Union is taking a much needed step forward in terms of digital operational resilience with the introduction of their new legislation, the Digital Operational Resilience Act (DORA). This means that financial service companies looking to operate in European markets must have clear plans for responding to and managing cyber risks. DORA will allow businesses operating across jurisdictions within the EU to reduce outages, manage data protection and privacy compliance issues more effectively, as well as provide greater assurance that customer data is secure during transactions. For professional clients in particular this could provide an improved level of protective measures something which may be essential given long-term economic uncertainty arising from global events at present.
Digital Operational Resilience Act (DORA) explained
The legislation requires financial services companies to identify, assess, and manage cyber risks proactively.
It also requires firms to establish a security culture supported by clear processes and policies.
These measures focus on protecting customer data from misuse or breaches.
Companies must ensure procedures meet high security standards to protect customers effectively.
They must also maintain clear incident response plans and investigation processes.
Firms need to align these processes with DORA compliance requirements.
In the event of an incident, companies must notify relevant authorities promptly.
They must also explain how they will prevent similar risks in the future.
The European Union published DORA in the Official Journal on December 27, 2022.
The regulation became effective on January 16, 2023.
DORA introduces strict requirements for financial institutions and critical third-party providers.
It mandates new systems, controls, risk frameworks, policies, and ICT outsourcing contract clauses.
The regulation provides a two-year implementation period.
Organizations must meet all requirements by January 17, 2025.
DORA strengthens digital resilience across Europe’s financial services sector.
It aims to increase customer confidence and improve protection in a rapidly changing digital environment.
Impact of DORA on Financial Institutions
Financial institutions operating in or serving the EU face substantial impact from DORA. They must establish robust cyber risk management plans tailored to their size and customer base. Compliance includes regular risk assessments, monitoring of third-party providers, and investment in threat detection systems.
The introduction of DORA places a greater burden on companies which should result in increased costs for financial institutions. Companies must hire more staff or utilize outsourcing solutions in order to comply with the regulation, as well as invest in technology and processes to ensure they have suitable risk management measures in place.
Financial institutions will need a framework for ICT risk management that is completely comprehensive to handle this. The ability to identify risks, safeguard ICT systems, reduce the risk of cybersecurity incidents, detect suspicious activities, recover from negative incidents, and have backup and other recovery techniques in place will also be required. This should help financial institutions deal ICT risks effectively.
Businesses must evaluate third-party service risks and enforce appropriate provider usage under DORA guidelines. This regulation covers banks, investment firms, insurance entities, and more, aiming to enhance digital resilience across the financial sector.
Managing Risks with ICT Suppliers
Financial institutions will have to test their operational resilience frequently under DORA. Firms will be expected to test against the risks that are most pertinent to their investment services and business lines. Testing should follow a risk-based approach. By doing this, businesses may verify that the cyber risk controls in place are specific to their own operations. Firms will be compelled to document any incidents, including cyberattacks, and report them to the appropriate authority.
Financial institutions must closely monitor risks from third-party ICT suppliers and include monitoring details in contracts. They should share cyberthreat intelligence securely among themselves to protect sensitive information.
Requirements for Financial institutions to comply with DORA
- Investing in the appropriate technology and processes to ensure the organization has suitable cyber risk management measures in place.
- Evaluating the risks associated with using third-party services, and have rules in place to guarantee that only appropriate third-party services are employed.
- Documenting any incidents, including cyberattacks, and report them to the appropriate authority.
- Monitoring and safeguarding ICT systems.
- Reducing the risk of cybersecurity incidents, detecting suspicious activities, and having backup and other recovery techniques in place.
- Frequently testing operational resilience against applicable risks.
- Sharing intelligence and information on cyber threats among themselves through secure systems that safeguard potentially sensitive material.
- Implementing appropriate measures to protect against cyber threats in order to ensure the continuity of operations.
- Maintaining a framework for ICT risk management that is comprehensive and addresses all IT risks.
- Planning for potential emergencies and having contingency plans in place to respond quickly to any incidents or threats.
Financial entities regulated under DORA
- Investment firms
- Credit institutions
- Payment institutions and electronic money institutions
- Crypto-asset service providers
- Trading venues and trade repositories
- Insurance and reinsurance undertakings and intermediaries
- Central securities depositories
- Central counterparties
- Credit rating agencies
- AIFMs and management companies
- Data reporting service providers
- Statutory auditors and audit firms
- Administrators of critical benchmarks
- Crowdfunding service providers
- Securitization repositories
- Institutions for occupational retirement pensionsÂ
In conclusion, compliance with the principles of DORA is crucial for the financial services sector to be able to manage digital risks effectively. Financial institutions need to assess their operations and cyber security measures continually in order to remain compliant with DORA. This will help them protect their customers’ data and assets, reduce operational risks, and maintain a secure and reliable financial infrastructure.
