Digital Operational Resilience Act (DORA)

Prepare for DORA compliance with expert guidance to strengthen digital resilience and meet regulatory requirements.

Reliable and Accredited DORA

What is DORA?

The Digital Operational Resilience Act (DORA) is an EU regulation designed to safeguard the financial sector from operational disruptions in the digital age. Although passed in 2022, it comes into full effect on 17th January 2025. This regulation aims to ensure that financial institutions like banks, investment firms, and insurance companies can withstand and recover from ICT (Information and Communication Technology) threats such as cyber-attacks, IT failures, and data breaches. Essentially, DORA requires these organizations to have robust measures in place to manage their ICT risk, ensuring continuity of critical operations and the stability of the financial system.

While it’s an EU regulation, its impact is far-reaching. DORA applies to a wide range of financial entities operating within the EU, including banks, investment firms, insurance companies, and even crypto-asset service providers. Importantly, even organizations based outside of the EU, including those in the UK and US, may need to comply with DORA if they provide ICT services to financial entities within the scope of the regulation. This means that UK, US, and other global companies doing business with EU financial institutions will also need to ensure they meet DORA’s requirements.

Key Requirements of DORA

ICT Risk Management

Establish a thorough risk management framework to identify, assess, and mitigate ICT risks, including regular risk assessments, security controls, and incident response plans. This involves proactively identifying potential threats and vulnerabilities to minimize the likelihood of disruptions and establishing clear procedures for managing and recovering from incidents.

Incident Reporting

Implement a clear process for reporting major ICT incidents to the relevant regulatory authorities. This ensures transparency and facilitates a swift, coordinated response to minimize the impact of incidents. DORA outlines specific requirements for incident reporting, including timelines and content.

Operational Resilience Testing

DORA mandates regular testing to evaluate the effectiveness of your ICT resilience measures and your ability to respond to and recover from disruptions. This includes a range of security and resilience testing activities, such as vulnerability assessments and scans, network security assessments, gap analyses, penetration testing, Threat-Led Penetration Testing (TLPT) like TIBER-EU, and scenario-based tests.

Third-Party Risk Management

Exercise strong oversight of ICT third-party providers, including robust contract management and risk assessments. This includes ensuring your providers have adequate incident response capabilities and that your contracts address incident management and recovery. DORA requires organisations to assess and manage the risks associated with third-party ICT services, including their incident management processes.

Information Sharing

Participate in information sharing initiatives with other financial entities to enhance collective awareness of cyber threats and vulnerabilities. This helps organizations learn from each other’s incidents and improve their preparedness and incident response capabilities.

What We Do

DORA Gap Analysis

Dionach will conduct a thorough assessment of your current ICT risk management practices, including your security controls and incident response plans, and identify any gaps compared to DORA requirements.

Implementation Support

Dionach will guide you through the process of implementing the necessary policies, procedures, and controls to meet DORA obligations. This includes assisting with the development of incident response playbooks, enhancing your security awareness training, and implementing robust security measures.

ICT Risk Management

Our expertise in ICT risk management will help you establish a comprehensive framework tailored to your specific needs and risk profile. We can help you identify and assess your critical assets, vulnerabilities, and threats, and implement appropriate security measures, including:

o Penetration Testing: Dionach’s experienced penetration testers can identify vulnerabilities in your systems and applications before attackers do, helping you to proactively address security weaknesses.

o Red Teaming: We can conduct Threat-Led Penetration Testing (TLPT) in line with the TIBER-EU framework, using realistic attack scenarios based on your specific threat intelligence. This helps test your defenses and identify areas for improvement in your security controls and incident response processes.

Third-Party Risk Management

Dionach will assist you in effectively managing ICT third-party risks, ensuring your supply chain is resilient and secure. This includes conducting due diligence on your suppliers and helping you establish clear security requirements in your contracts.

Incident Response & Preparedness

We can help you prepare for and respond to security incidents, minimizing the impact of cyber-attacks and ensuring business continuity. This includes developing incident response plans, conducting tabletop exercises, and providing expert support during and after an incident.

Training and Awareness

We provide bespoke, interactive training workshops designed to raise DORA awareness and build your team’s understanding of key cybersecurity concepts. These workshops can be tailored to your specific needs and focus on areas such as DORA compliance, incident response, and threat-led penetration testing.

DORA Applicability Assessment

Unsure if DORA applies to your organization? Contact Dionach to help you determine your obligations under the regulation, even if you’re not based in the EU.

How We Work

We deliver the whole spectrum of cyber security services, from long-term, enterprise wide strategy and implementation projects to single penetration tests.