How to Prepare for the Digital Operational Resilience Act (DORA)

Why is DORA Being Introduced?

The EU has introduced DORA in recognition of the interconnectedness and dependency on digital services by the finance sector; with cyber threats becoming more sophisticated and prevalent, ensuring the resilience of digital infrastructures is absolutely imperative. DORA aims to address this by establishing a comprehensive regulatory framework that fosters resilience, transparency, and accountability within the financial services ecosystem.

Who is Impacted by DORA?

DORA impacts financial entities that deliver digital services in the EU. This means that if your organisation operates within EU countries, it will be impacted by DORA.

Its scope includes but is not limited to banks, insurance companies, investment firms, critical ICT third-party service providers including cloud computing service providers providing ICT services to financial entities, and electronic money institutions.

By applying to diverse financial entities, DORA seeks to create a level playing field and ensure consistent standards of operational resilience across the financial landscape.

How will DORA be Enforced?

DORA will be enforced by EU countries’ regulatory authorities, such as BaFin in Germany and the AMF in France. To enforce compliance with DORA, regulatory authorities will be empowered to:

• Conduct audits and inspections to assess adherence to DORA requirements.
• Impose penalties and sanctions for non-compliance, including fines and operational restrictions.
• Provide guidance and support to assist financial entities in meeting their obligations under DORA.
• Foster international cooperation and coordination to address cross-border implications of digital operational resilience.

Within DORA there are articles related to administrative and even criminal penalties for non-compliance, although there are at the time of writing no confirmed financial penalties that have been defined.

Of course, specific regulatory penalties are only one part of the damage non-compliance can cause. In the highly competitive finance industry, non-compliance can cause reputational damage that can result in tangible loss of consumer confidence – resulting in potential losses much greater than any fine a regulatory body may impose.

How Should You Respond to DORA?

To comply with DORA, organisations will be asked to upload a self-assessment that auditors from regulatory bodies will review and provide feedback on. These self-assessments will need to be evidenced, and this is where your organisation’s preparation for DORA will come into play.

Non-compliant self-assessments will receive a set of remediation activities and a timeline to complete them, and the failure to do so will result in penalties. So, the better your organisation’s cyber hygiene, the easier it will be for you to align with DORA’s requirements first time.

This may require a shift in approach for financial organisations, many of which are strong on overall risk management but less focused specifically on cyber risk management.

Six Degrees can deliver a gap analysis against DORA that will provide you with the insights you need to align your organisation to the regulation’s requirements ahead of January 2025.

How Six Degrees Can Help

DORA is a regulation, but the five key pillars of DORA are relevant to any organisation handling digital information. At Six Degrees, our Cyber Security Assurance team contains experts in DORA who can provide guidance on its requirements from both a technology perspective and a governance and risk angle. We can provide financial organisations with the technology and advice they need to optimise their cyber security postures, and ensure that their people, skills, technologies, and security practices are suited to the regulatory and best practice frameworks that they want to align with.

If you need support in preparing for DORA, or if you’d like to explore how your organisation can take steps to enhance its overall cyber security posture, speak to your Account Manager or book a call with a DORA expert to learn more.