DORA: Compliance With The EU Digital Resilience Act

The EU’s Digital Operational Resilience Act (Regulation (EU) 2022/2554) is a significant development in how the Bloc regulates finance. The deadline for complying with the EU’s new DORA regulation is fast approaching.

But what exactly is DORA, and what are the risks associated with non-compliance?

What Is DORA?

Currently, financial institutions manage the main operational risk categories via capital allocation. The difference post-DORA is that they will now be expected to manage all areas of operational resilience and adhere to a set of rules around protecting, detecting and containing ICT-related threats. 
 
DORA also sets out rules explicitly pertaining to ICT risk management, incident reporting, operational resilience testing and third-party risk monitoring. Within the regulation is the acknowledgement that such incidents and a lack of preparedness for them have the potential to impact the entire financial system in a major way – this is despite a “sufficient” level of capital for traditional risk assessments. 
 
Why Is DORA Important?
 
The main objective of DORA is to ensure all parties involved in the European financial system have adequate protection against cyber-attacks and other data-related risk factors. Part of this will require organisations to prove their resilience against various ICT-related threats.
 
Many of the finer technical details are still being finalised by local regulators. However, some key areas where DORA will impact have already been identified. These include:  

•    Risk Management
•    Incident Reporting
•    Testing and Scenario Analysis
•    Outsourcing Assessment
•    Supervision   

As a result, cyber-attacks – such as the recent event at Capita, should be avoided. In March 2023, Capita experienced a security breach that compromised its pension fund, with members being informed that their data had been stolen. The attack on the outsourcer’s administration services led to multiple private sector pension funds being affected.

The Problem

As promising as this sounds, there are inevitably some issues. All financial entities operating in the EU have a deadline of 17th January 2025 to be DORA-compliant – less than 18 months away. Time is of the essence here, as ISMS.online’s recent “The State of Information Security” report highlights. Drawing from 500 UK infosec professionals representing managers, directors and C-level executives, the average company takes 15.5 months to align its operations with any given regulation fully. 
 
Although the survey also found that just 27% of companies say they are struggling to comply with the regulation, this time window suggests otherwise. 
 
The Solution
 
Apart from the external pressure of deadlines, companies should be motivated to comply. One reason is that strong cyber-security, far from being a burden, is a significant competitive asset for any organisation. In today’s digital, fast-paced business environment, ensuring sound information security, data privacy, and cybersecurity is becoming ever more vital to the success and longevity of a business. 
 
To this end, smart, forward-thinking business leaders are mobilising their people and various software to place information security at the heart of the organisation. In doing so, they are positioning themselves ahead of their competition in multiple ways. 
 
One crucial benefit is the increased confidence stakeholders have in the business. Staff, customers and decision-makers can leverage this “digital trust” to seize new opportunities unavailable to those without superior information security. This increased level of trust will, in turn, accelerate regulatory compliance. 
 
Conversely, businesses that do not invest in this will have to deal with increased cyber-attacks, potentially deadly costs to finances and reputation. Worse still, the scope of cybercriminal activity is only becoming wider as we increase our reliance on data and cloud services. The result is a rise in industrial-scale cybercrime, as nefarious actors operate as businesses.
 
Safeguarding Future Prosperity 
 
As the deadline for DORA compliance draws closer, businesses must step up infosec investment to ensure they meet it on time. So, how does a business start making the transition?

It all begins with investments into the right technology, processes, and people that will ensure businesses have all they need to deliver a swift, effective counter to any inbound cyber threats and ensure regulatory compliance. 
 
But this cannot be achieved unless members of the organisation are well-informed. In the event of a crisis, employees are the first line – and often strongest – of defence and understand the role they have to play in safeguarding data and critical assets. Crucially, senior members of the organisation must demonstrate sound leadership and communication skills to establish a robust security culture.

Investing in this training and infrastructure today is the best way to ensure consistent, future-proof growth tomorrow.

Christopher Gill is Governance, Risk Management, Compliance and Audit Specialist at ISMS.online  

Image: Peter Linforth

You Might Also Read: 

Imminent: Cybersecurity Regulations For US Financial Services:

___________________________________________________________________________________________

If you like this website and use the comprehensive 6,500-plus service supplier Directory, you can get unrestricted access, including the exclusive in-depth Directors Report series, by signing up for a Premium Subscription.

  • Individual £5 per month or £50 per year. Sign Up
  • Multi-User, Corporate & Library Accounts Available on Request

Cyber Security Intelligence: Captured Organised & Accessible


 

« Understanding Malvertising Attacks
Beyond Traditional Security »

CyberSecurity Jobsite
Perimeter 81

Directory of Suppliers

XYPRO Technology

XYPRO Technology

XYPRO is the market leader in HPE Non-Stop Security, Risk Management and Compliance.

ZenGRC

ZenGRC

ZenGRC - the first, easy-to-use, enterprise-grade information security solution for compliance and risk management - offers businesses efficient control tracking, testing, and enforcement.

CYRIN

CYRIN

CYRIN® Cyber Range. Real Tools, Real Attacks, Real Scenarios. See why leading educational institutions and companies in the U.S. have begun to adopt the CYRIN® system.

NordLayer

NordLayer

NordLayer is an adaptive network access security solution for modern businesses — from the world’s most trusted cybersecurity brand, Nord Security. 

Perimeter 81 / How to Select the Right ZTNA Solution

Perimeter 81 / How to Select the Right ZTNA Solution

Gartner insights into How to Select the Right ZTNA offering. Download this FREE report for a limited time only.

mile2

mile2

Mile2 develop and deliver proprietary vendor neutral professional certifications for the cyber security industry.

Shavlik Protect

Shavlik Protect

Shavlik Protect is an easy-to-use security software solution that discovers missing patches and deploys them to the entire organization.

iXsystems

iXsystems

iXsystems is a leader in Open-Source enterprise server and storage solutions including Backup & Recovery to protect critical data.

QMS International

QMS International

QMS is one of the leading ISO certification bodies in the UK and serves clients worldwide.

Nethemba

Nethemba

Nethemba provide pentesting and security audits for networks and web applications. Other services include digital forensics, training and consultancy.

Executive Women's Forum (EWF)

Executive Women's Forum (EWF)

The Executive Women's Forum is the largest member organization serving emerging leaders and influential female executives in the Information Security, Risk Management and Privacy industries.

NPCore

NPCore

NPCore is specialized in defense solution against unknown APT and Ransomware and provides two-level defense on network and endpoint based on behavior.

Parsons

Parsons

Parsons has developed a converged security offering that combines cybersecurity, integrated network solutions, and critical infrastructure protection.

IoTsploit

IoTsploit

IoTsploit provides 20/20 visibility of network connections, protecting critical infrastructure assets from IoT vulnerabilities.

Titans24

Titans24

Titans24 is a Software-as-a-Service security platform for web applications. It prevents attacks on business websites that are protected under 11 cyber-security layers.

Australian Cyber Collaboration Centre (A3C)

Australian Cyber Collaboration Centre (A3C)

A3C assists business to understand and navigate the cyber ecosystem to address their specific cyber needs. It is a central connection point for businesses looking to improve their cyber resilience.

Vietnamese Security Network (VSEC)

Vietnamese Security Network (VSEC)

Vietnamese Security Network (VSEC) is an information security company providing website vulnerability scanning and monitoring services.

ITTAS

ITTAS

ITTAS is a multidisciplinary company specializing in information security and software and hardware protection software.

Horizon3.ai

Horizon3.ai

Horizon3.ai is a leader in security assessment and validation enabling continuous security overwatch from an attacker’s perspective through our NodeZero SaaS solution.

KirkpatrickPrice

KirkpatrickPrice

KirkpatrickPrice is dedicated to providing you with innovative security guidance and efficient audit services.

Action Fraud

Action Fraud

Action Fraud is the UK’s national reporting centre for fraud and cyber crime where you should report fraud if you have been scammed, defrauded or experienced cyber crime.