Introduction to DORA
The Digital Operational Resilience Act (DORA) is an EU regulation establishing a comprehensive framework for digital operational resilience in the financial sector. It entered into force on January 16, 2023, with application from January 17, 2025.
Why DORA?
Objectives:
Harmonize ICT risk requirements across EU
Address ICT third-party concentration risk
Ensure financial sector stability
Strengthen operational resilience
Regulatory Context
Replaces/Supplements:
EBA Guidelines on ICT and security
National ICT regulations
Outsourcing guidelines
Incident reporting requirements
Scope and Applicability
Financial Entities
In Scope:
Credit institutions
Investment firms
Insurance companies
Payment institutions
E-money institutions
Crypto-asset service providers
Central securities depositories
Trading venues
Asset managers
Exclusions:
Very small entities (certain exemptions)
Specific thresholds apply
ICT Third-Party Providers
Critical ICT Providers:
Designated by ESAs
Subject to oversight framework
Direct regulatory requirements
Five Pillars of DORA
Pillar 1: ICT Risk Management
Framework Requirements:
Comprehensive ICT risk management framework
Board responsibility and oversight
ICT risk management function
Regular review and update
Key Components:
Identification of ICT assets
Protection and prevention
Detection of anomalies
Response and recovery
Learning and evolving
Pillar 2: ICT Incident Management
Incident Classification:
Major ICT-related incidents
Significant cyber threats
Classification criteria
Reporting Requirements:
Initial notification
Intermediate report
Final report
Timelines specified
Reporting To:
Competent authorities
Clients (when appropriate)
ESAs consolidation
Pillar 3: Digital Operational Resilience Testing
Basic Testing:
Vulnerability assessments
Network security assessments
Gap analyses
Physical security reviews
Software security testing
Advanced Testing (TLPT):
Threat-led penetration testing
Critical functions focus
At least every 3 years
TIBER-EU framework
Who Must Conduct TLPT:
Significant financial entities
Systemic importance criteria
Competent authority designation
Pillar 4: ICT Third-Party Risk Management
Due Diligence:
Pre-contract assessment
Risk evaluation
Exit strategies
Contractual Requirements:
Service level descriptions
Data protection provisions
Audit rights
Exit provisions
Security requirements
Register of ICT Third Parties:
All ICT service providers
Criticality assessment
Updated maintenance
Pillar 5: Information Sharing
Voluntary Arrangements:
Cyber threat intelligence
TTPs sharing
Indicators of compromise
Trusted communities
Requirements:
Protect sensitive information
Competition law compliance
Notification to authorities
ICT Risk Management Framework
Governance
Board Responsibilities:
Define risk tolerance
Approve framework
Allocate resources
Review effectiveness
Management Body:
Ultimate responsibility
Active oversight
Regular reporting
Training requirements
ICT Risk Management Function
Requirements:
Independent function
Adequate resources
Clear responsibilities
Regular reporting
Alternative for Smaller Entities:
Proportionality principle
Combined functions possible
Documentation required
Key Policies
Required Documentation:
ICT risk management policy
Information security policy
Business continuity policy
Incident management policy
Third-party risk policy
Incident Reporting
Classification Criteria
Major Incident Indicators:
Client impact
Reputational impact
Duration
Geographical spread
Data losses
Critical services impact
Reporting Timeline
Initial Notification:
Within 4 hours of classification
As soon as reasonably practicable
Intermediate Report:
Within 72 hours
Update on status
Final Report:
Within 1 month
Root cause analysis
Remediation measures
Resilience Testing
Testing Requirements
All Financial Entities:
Annual testing program
Risk-based approach
Independent testing
Remediation tracking
Testing Types:
Vulnerability scanning
Open source analysis
Network security
Gap analysis
Physical security
Scenario-based testing
TLPT Requirements
Scope:
Live production systems
Critical functions
End-to-end testing
Execution:
External testers
Threat intelligence-led
Red team methodology
Purple team option
Third-Party Oversight
Critical ICT Providers
Designation Criteria:
Systemic importance
Substitutability
Number of financial entities
Criticality of services
Oversight Powers:
Information requests
Inspections
Recommendations
Penalty powers
Contractual Requirements
Mandatory Provisions:
Full service description
Locations of processing
Service levels
Assistance obligations
Termination rights
Audit access
Implementation Roadmap
Phase 1: Assessment (Q1 2024)
Activities:
Gap analysis against DORA
Current state documentation
Third-party inventory
Risk assessment
Phase 2: Design (Q2 2024)
Activities:
Framework design
Policy development
Process definition
Testing program design
Phase 3: Implementation (Q3-Q4 2024)
Activities:
Control implementation
Process operationalization
Testing execution
Third-party alignment
Phase 4: Validation (Q1 2025)
Activities:
Compliance validation
Documentation completion
Management attestation
Regulatory readiness
Proportionality
Simplified Requirements
Eligible Entities:
Small financial entities
Non-systemic institutions
Based on size and risk
Simplified Provisions:
ICT risk management
Testing requirements
Reporting obligations
Penalties
Administrative Sanctions
Financial Entities:
Member state determination
Effective, proportionate, dissuasive
Public disclosure
Critical ICT Providers:
ESA penalty powers
Up to 1% of average daily worldwide turnover
Periodic penalty payments
Conclusion
DORA establishes comprehensive ICT resilience requirements for EU financial entities. With application from January 2025, organizations must implement robust frameworks covering risk management, incident reporting, resilience testing, and third-party oversight to achieve compliance.