DORA: Compliance With The EU Digital Resilience Act

The EU’s Digital Operational Resilience Act (Regulation (EU) 2022/2554) is a significant development in how the Bloc regulates finance. The deadline for complying with the EU’s new DORA regulation is fast approaching.

But what exactly is DORA, and what are the risks associated with non-compliance?

What Is DORA?

Currently, financial institutions manage the main operational risk categories via capital allocation. The difference post-DORA is that they will now be expected to manage all areas of operational resilience and adhere to a set of rules around protecting, detecting and containing ICT-related threats. 
 
DORA also sets out rules explicitly pertaining to ICT risk management, incident reporting, operational resilience testing and third-party risk monitoring. Within the regulation is the acknowledgement that such incidents and a lack of preparedness for them have the potential to impact the entire financial system in a major way – this is despite a “sufficient” level of capital for traditional risk assessments. 
 
Why Is DORA Important?
 
The main objective of DORA is to ensure all parties involved in the European financial system have adequate protection against cyber-attacks and other data-related risk factors. Part of this will require organisations to prove their resilience against various ICT-related threats.
 
Many of the finer technical details are still being finalised by local regulators. However, some key areas where DORA will impact have already been identified. These include:  

•    Risk Management
•    Incident Reporting
•    Testing and Scenario Analysis
•    Outsourcing Assessment
•    Supervision   

As a result, cyber-attacks – such as the recent event at Capita, should be avoided. In March 2023, Capita experienced a security breach that compromised its pension fund, with members being informed that their data had been stolen. The attack on the outsourcer’s administration services led to multiple private sector pension funds being affected.

The Problem

As promising as this sounds, there are inevitably some issues. All financial entities operating in the EU have a deadline of 17th January 2025 to be DORA-compliant – less than 18 months away. Time is of the essence here, as ISMS.online’s recent “The State of Information Security” report highlights. Drawing from 500 UK infosec professionals representing managers, directors and C-level executives, the average company takes 15.5 months to align its operations with any given regulation fully. 
 
Although the survey also found that just 27% of companies say they are struggling to comply with the regulation, this time window suggests otherwise. 
 
The Solution
 
Apart from the external pressure of deadlines, companies should be motivated to comply. One reason is that strong cyber-security, far from being a burden, is a significant competitive asset for any organisation. In today’s digital, fast-paced business environment, ensuring sound information security, data privacy, and cybersecurity is becoming ever more vital to the success and longevity of a business. 
 
To this end, smart, forward-thinking business leaders are mobilising their people and various software to place information security at the heart of the organisation. In doing so, they are positioning themselves ahead of their competition in multiple ways. 
 
One crucial benefit is the increased confidence stakeholders have in the business. Staff, customers and decision-makers can leverage this “digital trust” to seize new opportunities unavailable to those without superior information security. This increased level of trust will, in turn, accelerate regulatory compliance. 
 
Conversely, businesses that do not invest in this will have to deal with increased cyber-attacks, potentially deadly costs to finances and reputation. Worse still, the scope of cybercriminal activity is only becoming wider as we increase our reliance on data and cloud services. The result is a rise in industrial-scale cybercrime, as nefarious actors operate as businesses.
 
Safeguarding Future Prosperity 
 
As the deadline for DORA compliance draws closer, businesses must step up infosec investment to ensure they meet it on time. So, how does a business start making the transition?

It all begins with investments into the right technology, processes, and people that will ensure businesses have all they need to deliver a swift, effective counter to any inbound cyber threats and ensure regulatory compliance. 
 
But this cannot be achieved unless members of the organisation are well-informed. In the event of a crisis, employees are the first line – and often strongest – of defence and understand the role they have to play in safeguarding data and critical assets. Crucially, senior members of the organisation must demonstrate sound leadership and communication skills to establish a robust security culture.

Investing in this training and infrastructure today is the best way to ensure consistent, future-proof growth tomorrow.

Christopher Gill is Governance, Risk Management, Compliance and Audit Specialist at ISMS.online  

Image: Peter Linforth

You Might Also Read: 

Imminent: Cybersecurity Regulations For US Financial Services:

___________________________________________________________________________________________

If you like this website and use the comprehensive 6,500-plus service supplier Directory, you can get unrestricted access, including the exclusive in-depth Directors Report series, by signing up for a Premium Subscription.

  • Individual £5 per month or £50 per year. Sign Up
  • Multi-User, Corporate & Library Accounts Available on Request

Cyber Security Intelligence: Captured Organised & Accessible


 

« Understanding Malvertising Attacks
Beyond Traditional Security »

CyberSecurity Jobsite
Perimeter 81

Directory of Suppliers

ZenGRC

ZenGRC

ZenGRC - the first, easy-to-use, enterprise-grade information security solution for compliance and risk management - offers businesses efficient control tracking, testing, and enforcement.

Perimeter 81 / How to Select the Right ZTNA Solution

Perimeter 81 / How to Select the Right ZTNA Solution

Gartner insights into How to Select the Right ZTNA offering. Download this FREE report for a limited time only.

Authentic8

Authentic8

Authentic8 transforms how organizations secure and control the use of the web with Silo, its patented cloud browser.

Resecurity, Inc.

Resecurity, Inc.

Resecurity is a cybersecurity company that delivers a unified platform for endpoint protection, risk management, and cyber threat intelligence.

NordLayer

NordLayer

NordLayer is an adaptive network access security solution for modern businesses — from the world’s most trusted cybersecurity brand, Nord Security. 

Dtex Systems

Dtex Systems

DTEX Systems is the global leader for insider risk management. We empower organizations to prevent data loss by proactively stopping insider risks from becoming insider threats.

Dome9

Dome9

Dome9 is a cloud firewall management service that stops vulnerabilities, secures remote access, and centralizes policy management.

CloudSigma

CloudSigma

CloudSigma, a pure-cloud IaaS provider offers flexible and innovative cloud hosting solutions for companies of all sizes both in Europe and the US.

Thales

Thales

Thales provides solutions, services and products that help its customers in the defence, aeronautics, space, transportation and digital identity and security markets to fulfil their critical missions.

CSIRT-CY

CSIRT-CY

CSIRT-CY is the National Computer Security Incident Response Team for Cyprus.

Havelsan

Havelsan

HAVELSAN is a leading technology company in Turkey developing indigenous systems for domestic and foreign military, public and private sector clients.

Council for Information & Communication Technologies (CTIC)

Council for Information & Communication Technologies (CTIC)

CTIC was set up to address specific issues in the field of ICT relevant to the implementation of electronic government.

RIGCERT

RIGCERT

RIGCERT provides training, audit and certification services for multiple fields including Information Security.

Infodas

Infodas

Infodas provides Cybersecurity and IT consulting / system integration services as well as a range of innovative Cybersecurity products to public sector and commercial clients.

Morphus Information Security

Morphus Information Security

Morphus is an information security company providing Red Team, Blue Team and GRC services as well as conducting research in cybersecurity and threat analysis.

ReFirm Labs

ReFirm Labs

ReFirm Labs provides the tools you need for firmware security, vetting, analysis and continuous IoT security monitoring.

Verificient Technologies

Verificient Technologies

Verificient Technologies specializes in biometrics, computer vision, and machine learning to deliver world-class solutions in continuous identity verification and remote monitoring.

Neovera

Neovera

Neovera is a trusted provider of managed services including cyber security and enterprise cloud solutions, committed to delivering results through the innovative use of scalable enterprise-grade tech.

Wolverhampton Cyber Research Institute (WCRI)

Wolverhampton Cyber Research Institute (WCRI)

Wolverhampton Cyber Research Institute builds on the strength of its members in the area of network and communication security, artificial intelligence, big data and cyber physical systems.

Hexaware Technologies

Hexaware Technologies

Hexaware is an automation-led next-generation service provider delivering excellence in IT, BPO and Consulting services.

Radiance Technologies

Radiance Technologies

Radiance solutions provide technological advantage and operational superiority for our nation in the areas of intelligence, cyber and advanced weapon systems.