Understanding DORA: What it means for financial entities

Financial entities face increasing pressure to secure their IT infrastructure against cyber threats while maintaining resilience during system outages or cyber-attacks.

This has led the European Union to introduce the Digital Operational Resilience Act (DORA), a regulatory framework aimed at fortifying the financial sector's ability to withstand and recover from digital disruptions.

DORA represents a shift towards more rigorous operational resilience standards for financial entities, with crucial implications across technology management, cybersecurity, and risk mitigation. 

What is DORA? 

DORA is part of the EU’s Digital Finance Strategy and specifically focuses on the digital operational resilience of financial services within the EU. Its core goal is to ensure financial institutions can continue functioning despite adverse digital events, such as cyber-attacks, system failures, or other technical disruptions.

DORA establishes a unified regulatory standard for financial firms, ensuring consistency across the EU in managing operational risks tied to information and communications technology (ICT). 

Key pillars of DORA 

DORA’s framework revolves around several key components: 

1. ICT risk management: Financial entities must establish robust ICT risk management frameworks, which include regular assessments, mitigation plans, and response protocols. This framework must be regularly updated to account for evolving threats. 
    
2. Incident reporting: DORA requires financial institutions to promptly report significant ICT-related incidents to the authorities. This transparency not only aids in risk assessment but also facilitates coordinated responses across the sector. 
    
3. Testing digital resilience: Regular and comprehensive testing, such as penetration testing and simulation exercises, are mandated to ensure systems can withstand various cyber-attacks or operational failures. 
    
4. Third-party risk management: DORA extends its regulatory reach to include third-party providers, such as cloud service vendors, whose ICT services are critical for financial institutions. Financial firms must monitor and manage risks associated with these third-party relationships. 
    
5. Information sharing: DORA encourages financial entities to share information about digital threats and best practices. This collective approach to cybersecurity enables entities to stay proactive in defending against emerging threats. 

What DORA means for financial entities 

For financial institutions, DORA represents both a challenge and an opportunity to strengthen digital resilience. Some of the most significant impacts include: 

• Increased compliance requirements: DORA’s standards demand financial entities to overhaul or enhance their existing risk management frameworks, which might require additional resources and staff dedicated to compliance and cybersecurity. 
• Enhanced trust with customers and partners: By aligning with DORA, financial entities can demonstrate their commitment to secure, resilient operations. This can lead to greater confidence from customers and stakeholders who prioritise data security and continuity. 
• More structured third-party oversight: Financial entities must also scrutinise third-party providers, meaning closer oversight of vendors like cloud services. This can lead to stronger service-level agreements and more rigorous risk assessments of external partners. 
• Preparation for future threats: DORA’s regular testing requirements push financial institutions to proactively adapt to a changing threat landscape, potentially saving costs and reputational damage from breaches or operational disruptions. 

The next steps 

DORA is expected to be fully effective across EU countries by 17 January 2025, giving financial institutions time to align their operations with these new standards. Compliance will likely require financial institutions to invest in technology, skilled personnel, and partnerships that enable agile response capabilities. 

For financial entities, DORA signifies a significant step toward ensuring operational continuity and resilience in a digital world.