The European Union’s Digital Operational Resilience Act (DORA) is set to go into effect on January 17, 2025, and with it will come new information security and risk management requirements placed on EU financial service providers and their associated critical third-party technology entities.
First introduced by the European Commission (EC) in September 2021 and then later formally adopted by the Council of the European Union (EU) and the European Parliament in November 2022, DORA will require financial services organizations to meet risk management, incident reporting, digital operational resiliency testing, information and communications technologies (ICT) third-party risk and information and intelligence sharing standards.
Following 2020 report released by the European Systemic Risk Board (ESRB), as well as calls from the European Securities and Markets Authority (ESMA) and European Supervisory Authorities (ESAs), it was found that given the high level of interconnectedness across the financial and ICT industries (FinTech), there needed to be a systematic, unified, and cohesive approach to managing ongoing risks to the financial sector within the EU.
In response to these issues, the EC proposed DORA. DORA, therefore, attempts to not only address the aforementioned flaws in the FinTech industries but to also to increase the overarching digital resilience of these industries by introducing a modernized approach to ICT risk management (both in-house and in reference to third parties), testing as well as incident awareness and reporting.
Before we dive into DORA’s requirements, it’s important to know Trustwave has extensive experience delivering various DORA-related requirements. Trustwave is well-positioned to assist organizations in any phase of your transition to DORA. This includes and is not limited to initial DORA gap assessments, right through to more niche activities such as threat-led penetration testing. Get in touch with the EMEA Cyber Advisory Team today to find out how we can help you in your journey to become DORA compliant.
To first understand whether your organization will be affected by DORA, it is necessary to first analyze whether it falls under the remit of DORA.
Broadly, DORA will encompass all financial entities in the EU, as well as third-party technology service providers who supply a financial entity with ICT offerings or services.
To drill down even further within the context of DORA, a financial entity is therefore considered to be any of the following This list is not exhaustive and does not include certain exemptions and inclusions; for further details, contact the relevant regulatory body.
Moreover, if you are an organization that is a financial entity, other than a trading venue, a central counterparty, a trade repository or a central securities depository, which employs fewer than 10 persons and has an annual turnover and annual balance sheet total that does not exceed EUR 2 million, you would be considered a micro-enterprise under DORA. This means you do not have to meet the same rigorous requirements of larger organizations.
Dissimilarly, DORA purposefully describes critical third-party technology service providers in a more holistic light in line with their ICT services. As such, DORA defines these service providers as those “digital and data services provided through ICT systems to one or more internal or external users on an ongoing basis, including hardware-as-a-service and hardware services, which includes the provision of technical support via software or firmware updates by the hardware provider, excluding traditional analogue telephone services.”
Whilst DORA does not apply directly to UK-based institutions due to Brexit, it is likely, due to the extensive financial linkages and cross-jurisdictional entities shared by the EU and UK many UK institutions and ICT services providers will likely be affected by DORA.
Although DORA does not greatly depart from current UK regulatory requirements, such as the incoming PS21/3 (Building operational resilience) imposed by the Financial Conduct Authority (FCA), it does expand on and include more nuanced requirements. Such requirements broadly appear to surround:
Additionally, unlike other financial regulations, DORA has an extensive scope that applies to non-traditional financial institutions such as crypto-asset and crowdfunding service providers, as well as critical ICT service providers. These services, which ordinarily and previously have not been subject to extensive regulation, may have to meet additional actions if deemed to fall within the scope of DORA.
In light of these differences, institutions and service providers that fall within the scope of DORA should map their current approach to information security against those mandated within DORA. This process of mapping, often referred to as a gap or dependency analysis, will enable institutions and service providers to identify shortcomings in their current approach, thus enabling remediation by implementing the appropriate DORA-aligned action item or activity.
Now that we have established whether or not DORA applies to your organization, it is critical to understand the key requirements of DORA and how these may impact your organization’s current approach to cyber and information security.
DORA has five key pillars which make understanding these requirements straightforward These are:
Contained within DORA’s ICT Risk Management requirements are specific conditions an organization must have in place:
To ensure the appropriate protocols are in place when an incident occurs DORA outlines that specific requirements must be met in relation to ICT-related incident management, classification, and reporting. Please note specific organizations may have additional responsibilities with respect to incident reporting, however broadly, such requirements include:
Please note the ESA is likely to release further information pertaining to these specific requirements at some point in the first half of 2024. This new information may include frameworks or standardized templates to guide these relationships in a streamlined and compliant manner.
Digital resilience is at the core of DORA. As such, some organizations may have additional requirements imposed on them that specify the following:
To safeguard against supply chain risk, DORA has introduced a series of measures designed to increase compliance and collaboration between organizations and their third-party ICT suppliers. Such measures include:
Please note the ESA is like to release further information pertaining to these specific requirements during the first half of 2024. The release of this information may include frameworks or standardized templates to guide these relationships in a streamlined and compliant manner.
To further enhance cross-sector collaboration, DORA will introduce an information-sharing arrangement to enable the fintech industry to respond jointly to potential cyber threats. In doing so, DORA outlines that these arrangements must:
Whilst all these requirements may seem extensive, they are not dissimilar to the controls imposed by other internationally recognized standards such as the NIST CSF and ISO27001:2022. As such analyzing DORA requirements alongside your Statement of Applicability or Control Library may give you a good understanding of your organization’s current stance against DORA.
Moreover, it is worth highlighting that many large institutions, such as banks, are likely to already have a great number of these requirements are already in place. As such, it is likely the burden to implement DORA will fall on smaller entities. Despite this, analyzing the scope of DORA, as well as the principle of proportionality and definitions, contained within the regulation may provide some relief due to certain exemptions for smaller organizations.
As an EU regulation, non-compliance with DORA enables member states to impose sanctions and fines for breaching the regulation. It is to be noted that the severity of the penalty, as with any punishment, will differ based on the nature, degree of the infringement, and the jurisdiction in which it took place. Consequently, it is therefore imperative that the organization begin complying with DORA early to ensure compliance and prevent penalties.