DORA - Digital Operational Resilience

DORA - Digital Operational Resilience Act

The Digital Operational Resilience Act (DORA) establishes a comprehensive framework for ICT risk management in the EU financial sector, applying from January 2025.

Scope

Entities Covered

• Credit institutions
• Investment firms
• Insurance undertakings
• Payment institutions
• Electronic money institutions
• Crypto-asset service providers
• Trading venues
• Central securities depositories
• Fund managers
• Credit rating agencies
• ICT third-party service providers (critical)

Five Pillars

1. ICT Risk Management

Governance

• Management body responsibility
• Dedicated ICT risk management function
• Clear roles and responsibilities

Risk Framework

• Identification of ICT risks
• Protection and prevention
• Detection capabilities
• Response and recovery

Business Continuity

• ICT business continuity policy
• Response and recovery plans
• Regular testing

2. ICT Incident Management

Classification

• Major incidents criteria
• Severity assessment
• Impact evaluation

Reporting

• Initial notification (4 hours for major)
• Intermediate report (within 3 days)
• Final report (within 1 month)

Learning

• Root cause analysis
• Post-incident reviews
• Remediation tracking

3. Digital Operational Resilience Testing

Basic Testing

• Vulnerability assessments
• Network security testing
• Gap analyses
• Physical security reviews
• Source code reviews
• Scenario-based testing
• Compatibility testing
• Performance testing
• Penetration testing

Threat-Led Penetration Testing (TLPT)

• For significant entities
• At least every 3 years
• Red team exercises
• Based on TIBER-EU

4. ICT Third-Party Risk Management

Due Diligence

• Risk assessment before contracting
• Exit strategies
• Subcontracting controls

Contractual Requirements

• Service level agreements
• Security requirements
• Audit rights
• Termination provisions

Register

• Information register of all ICT services
• Dependencies mapping
• Regular updates

5. Information Sharing

Cyber Threat Intelligence

• Voluntary sharing arrangements
• Trusted communities
• Anonymisation where appropriate

Critical ICT Providers

Designation

• Identified by ESAs
• Systemic importance criteria
• Lead overseer assigned

Oversight Framework

• Recommendations by lead overseer
• Inspections and assessments
• Enforcement powers