The Rise of DORA: A New Era for Cybersecurity in Financial Services
In January 2023, the European Union passed the Digital Operational Resilience Act (DORA), which will come into full force by January 2025. DORA is designed to address growing cybersecurity risks and ensure that financial services (FS) firms can withstand disruptions caused by digital incidents. While DORA will not apply in the UK directly, it is highly relevant for UK-based businesses that operate within the EU or provide ICT services to EU financial firms.
This regulation aims to standardise the management of cybersecurity risks across the financial sector and improve operational resilience. It’s critical that businesses in the financial services sector take the necessary steps to comply with DORA in order to avoid potential fines and penalties.
What is DORA, and Who Does It Apply To?
The Digital Operational Resilience Act (DORA) is a comprehensive regulation focused on improving how financial services companies across the EU manage cybersecurity risks. DORA requires firms to:
- Report cybersecurity incidents
- Test their operational resilience against cyber threats
- Manage risks from third-party vendors and suppliers
DORA is not just another set of cybersecurity guidelines; it represents a shift towards a more robust, standardised approach to digital security in the financial sector. The regulation applies to a wide range of financial services entities, including:
- Banks
- Credit institutions
- Payment providers
- Investment firms
- Insurance businesses
- Credit rating agencies
- Crypto asset companies
- Crowdfunding services
If you operate in the financial sector and have a presence in the EU, you need to understand how DORA impacts your operations and ensure compliance to reduce the risk of fines.
Key Pillars of DORA Compliance
DORA focuses on five critical areas to improve the resilience and security of financial institutions:
- ICT Risk Management
DORA requires firms to implement comprehensive IT risk management practices. This includes identifying and mitigating risks to digital operations and ensuring your firm has the necessary security tools in place to maintain operational resilience. - ICT-Related Incident Management, Classification & Reporting
Firms must develop procedures to detect and respond to cybersecurity breaches. This includes establishing clear policies for incident reporting and classification. Major incidents need to be reported within 24 hours, with updates provided throughout the investigation. - Digital Operational Resilience Testing
DORA mandates regular testing of your firm’s cybersecurity measures. This involves vulnerability assessments, security audits and compliance testing. Based on the findings, firms must enhance their security infrastructure to address any weaknesses. - ICT Third-Party Risk Management
Many financial services rely on third-party vendors, especially for IT services. DORA requires firms to assess the cybersecurity practices of their suppliers and ensure that their security standards align with DORA’s requirements. This includes reviewing contracts and SLAs to ensure third-party vendors maintain robust security protocols. - Information Sharing Arrangements
Financial services firms are required to share critical information about emerging cybersecurity threats with the relevant authorities and the wider industry. For example, if you notice an increase in DDoS attacks targeting your business or a specific market, you must report it to ensure the industry stays alert to evolving threats.
How to Avoid DORA Fines: Achieving Compliance
Non-compliance with DORA can result in significant fines and penalties. To avoid these, firms must ensure they have a comprehensive cybersecurity and resilience strategy in place that meets DORA’s requirements. Here’s what you need to do:
- Document Policies and Procedures: Ensure that you have clear, well-documented policies for cybersecurity risk management, incident reporting, and third-party vendor management. Regularly review and update these policies to remain compliant.
- Cyber Resilience Strategy: Develop and implement a cyber resilience strategy as outlined in Article 6(8) of DORA. This should include your business continuity plan and response protocols for cyber threats, data breaches, and operational disruptions.
- Continuous Monitoring and Testing: Conduct regular vulnerability assessments, penetration tests, and resilience testing to ensure that your systems remain secure. Keep records of these tests and any remedial actions taken to address identified risks.
- Third-Party Risk Management: Review your suppliers’ cybersecurity practices and ensure they align with DORA’s requirements. This includes requiring vendors to meet specific security standards and implementing penalties for non-compliance.
The Importance of Continuous Compliance
DORA compliance is not a one-off task but an ongoing process. As cyber threats evolve and new vulnerabilities emerge, financial services companies must continuously adapt and improve their security measures. By embracing a culture of continuous compliance, firms can stay ahead of potential risks and avoid penalties for non-compliance.
Evolving Digital Landscape
With the full implementation of DORA by January 2025, financial services firms must act quickly to ensure they meet the regulation’s requirements. While DORA aims to improve cybersecurity resilience across the sector, it also comes with significant obligations. By focusing on the five key pillars of compliance and ensuring continuous improvement, firms can avoid fines and ensure they are prepared for the evolving digital landscape.
________________________________________________________________________________
If you need assistance with your organisation’s cybersecurity strategy, contact us today for expert guidance!