European Council Adopts Law on Digital Operational Resilience (1 / 6)

The EU strengthens IT security for financial companies such as banks, insurance companies and securities firms through a provisional agreement on DORA

Introduction

Background

Timelines

Scope

Requirements & Elements

Conclusion

Strengthening Resilience in the EU Financial Sector

The financial sector plays a crucial role in the stability and functioning of the economy. However, the increasing dependence on digital technologies means that the sector faces new risks and challenges. To address these challenges, the European Union has introduced the Digital Operational Resilience Act (DORA). In this article, we will examine what DORA is, its background, timelines, scope and what it encompasses.

What is the Digital Operational Resilience Act (DORA)?

The Digital Operational Resilience Act (DORA), also known as Regulation (EU) 2022/2554, is a regulatory framework aimed at strengthening the operational resilience of financial undertakings in the European Union. Before the introduction of DORA, financial institutions managed operational risks primarily through capital allocation, but did not address all components of operational resilience. DORA closes this gap by establishing rules for protection, detection, containment, recovery and remediation capabilities against ICT-related incidents.

Background

The need for a comprehensive framework addressing digital operational resilience in the financial sector became clear due to increasing cyber attack risks. In response to these risks, the EU introduced the Digital Operational Resilience Act to strengthen IT security for financial companies, including banks, insurance companies and investment firms.

Timelines

The Digital Operational Resilience Act was formally adopted by the European Council on 28 November 2022. It was published on 27 December 2022 as Regulation (EU) 2022/2554 in the Official Journal of the European Union. The Regulation enters into force on the twentieth day after its publication in the Official Journal and will be applied from 17 January 2025.

Scope

DORA establishes uniform requirements regarding the security of network and information systems supporting the business processes of financial undertakings. These requirements apply to various aspects, including:

• Management of Information and Communication Technology (ICT) risks
• Reporting of major ICT-related incidents and significant cyber threats
• Reporting of major operational or security-related payment incidents
• Digital operational resilience testing
• Exchange of information and intelligence regarding cyber threats and vulnerabilities
• Measures for sound management of ICT third-party risks
• Contractual arrangements between ICT third-party service providers and financial undertakings
• Establishment and implementation of the supervisory framework for critical ICT third-party service providers
• Cooperation between competent authorities, supervision and enforcement

Contractual arrangements between financial undertakings and ICT third-party service providers are also covered under DORA. The Regulation establishes rules for these arrangements and aims to ensure that financial undertakings have effective supervision and control over ICT services provided by third parties.

DORA Requirements and Elements

ICT Risk Management: Financial undertakings must establish robust ICT risk management capabilities to identify, assess and mitigate potential risks. This includes implementing appropriate security measures, conducting regular risk assessments and developing incident response plans.

Incident Reporting: DORA emphasizes the importance of incident reporting to improve operational resilience. Financial undertakings are required to report major ICT-related incidents, significant cyber threats and major operational or security-related payment incidents to the competent authorities. This ensures that relevant stakeholders are informed of potential risks and can take appropriate mitigation measures.

Digital Resilience Testing: To ensure the effectiveness of their operational resilience measures, financial undertakings must conduct digital resilience testing. This involves simulating various scenarios and assessing the ability to withstand and recover from ICT-related disruptions. Testing helps identify vulnerabilities and gaps, enabling undertakings to strengthen their systems and processes.

Third-Party Risk Management: Financial undertakings often rely on third parties for various ICT-related services. DORA emphasizes the need for sound management of ICT third-party risks. Undertakings must establish measures to assess and monitor the risks associated with these service providers to ensure they meet required security and resilience standards.

Information and Intelligence Sharing: Information sharing plays a crucial role in combating cyber threats and improving overall resilience. DORA promotes the sharing of information and intelligence relating to cyber threats and vulnerabilities. Financial institutions are encouraged to cooperate and exchange relevant information to stay ahead of emerging risks.

Conclusion

The Digital Operational Resilience Act is a critical regulation that strengthens the operational resilience of the EU financial sector. By establishing specific requirements and elements, it ensures that financial institutions have robust systems and processes in place to mitigate risks associated with ICT incidents. DORA emphasizes the importance of ICT risk management, incident reporting, digital resilience testing, third-party risk management and information sharing. These measures enhance the overall resilience of financial institutions and contribute to the stability of the financial system.

As financial institutions prepare to implement DORA, it is important for them to understand the requirements and take the necessary steps to comply with the regulation. By doing so, they can improve their operational resilience and protect themselves against potential risks associated with ICT incidents. Remember, the Digital Operational Resilience Act (DORA) is a significant step in strengthening the digital resilience of the financial sector by ensuring its ability to withstand and recover from ICT-related disruptions. By following the requirements and applying best practices, financial institutions can proactively manage digital risks and improve their overall operational resilience.

For further information, please visit the following articles:

• EUROPEAN COUNCIL ADOPTS LAW ON DIGITAL OPERATIONAL RESILIENCE (1/6)
• MASTERING ICT THIRD-PARTY RISK (2/6)
• STRENGTHENING THE FRONTLINE (3/6)
• ICT RISK: IDENTIFY, ASSESS, PRIORITIZE YOUR CYBERSECURITY (4/6)
• BUILDING A STRONG DEFENSE (5/6)
• REPORTING FOR RESILIENCE (6/6)