What is DORA and what should you know about it?
The rapid development of technology and its growing use in the financial sector have led to increased cybersecurity risks. At the same time, financial companies are becoming more dependent on various service providers. This reliance means that a single cloud service outage could potentially disrupt multiple banks or payment systems simultaneously, causing widespread interruptions to everyday life.
The Digital Operational Resilience Act (DORA), which came into effect on January 17 this year, aims to prevent cyber threats and reduce the impact of incidents on businesses and the broader European financial sector. By addressing cyberattacks and other information and communication technology (ICT) disruptions, DORA helps ensure the sustainability, reliability, and security of companies and their customers' data.
Who does DORA apply to?
DORA applies to companies in the EU financial sector and to their service providers.
Here are the main types of businesses and organizations affected by DORA:
- Banks and credit institutions: All credit institutions, including retail banks, investment banks, and savings banks.
- Payment institutions and e-money providers: Companies offering payment solutions or digital wallets.
- Investment firms and asset managers: Providers of investment services such as crowdfunding platforms, asset managers, and alternative investment fund managers (AIFMs).
- Insurance and reinsurance companies: Insurance companies and pension funds.
- Crypto-asset service providers (CASPs): Businesses like cryptocurrency exchanges (CEX), wallet service providers, and other crypto-related companies licensed under the Markets in Crypto-Assets Regulation.
- Trading venues and market infrastructure providers: Central securities depositories (CSDs), stock exchanges, clearinghouses, and settlement institutions (CCPs).
- Data transmission service providers: Companies managing financial data reporting and sharing.
- Third-party ICT service providers: Technology companies providing services to the financial sector, such as cloud service providers or software developers.
Key requirements of DORA
- ICT Risk Management
Companies must establish frameworks to identify, assess, and manage ICT-related risks. They should also develop business continuity and recovery plans to minimize the impact of incidents and ensure quick recovery.
- Incident Reporting
Companies are required to monitor, detect, document, and report significant ICT incidents. Serious cyber incidents must be reported promptly to supervisory authorities (Financial Supervisory Authority in Estonia), clients, and users.
- Testing Digital Operational Resilience
Regular testing of digital operational resilience is required to ensure readiness for responding to ICT incidents.
- Managing Third-party ICT Risks
Companies must manage risks associated with third-party ICT service providers. This includes maintaining an overview of all service providers, setting clear risk management rules, conducting thorough risk assessments before signing contracts, and ensuring agreements include provisions for security and continuity during disruptions.
The exact requirements depend on the size of the company, the scope of its activities, and its risk profile.
Full text of the DORA regulation is available at Regulation - 2022/2554 - EN - DORA - EUR-Lex
You can read more about the DORA-related services offered by Grant Thornton Baltic here.
If you have any questions about DORA or other information security topics, our information security specialists will be happy to answer them.
Contact us!
