Digital Operational Resilience Act (DORA)

ICT and cyber-related incident management

DORA requires financial entities to have an ICT-related incident management process that:

• establishes procedures to identify, track, log, categorise and classify ICT-related incidents according to the priority, severity and criticality of services impacted;
• assigns roles and responsibilities that need to be activated for different ICT- related incident types and scenarios;
• sets out plans for communication to staff, external stakeholders and media, and for notifications to clients and counterparts as appropriate;
• ensures that major ICT-related incidents are reported to relevant senior management and that the management body is informed of major ICT-related incidents, explaining the impact, response and additional controls to be established as a result of ICT-related incidents; and
• establishes ICT-related incident response procedures to mitigate the impacts and ensure that services become operational and secure in a timely manner.

Digital operational resilience testing

DORA requires all entities to implement a sound and comprehensive digital operational resilience testing programme. It should:

• take a risk-based approach, accounting for the evolving landscape of ICT and cyber risks, any specific threats to which the financial entity is — or might be — exposed, the criticality of information assets and services provided and so on;
• ensure that tests are undertaken by independent parties (internal or external);
• identify, mitigate and promptly eliminate any weaknesses, deficiencies or gaps; and
• ensure that all critical tools and applications are tested at least annually.
• Threat-led penetration testing is explicitly required by DORA, which includes requirements for the entity that extend to ICT/critical third-party service providers. The competent authorities must validate the scope of this testing.

ICT third-party risk management

DORA requires financial entities to manage ICT third-party risk as an integral component within their ICT risk management framework and in accordance with the principles defined. These principles include the following:

• The principle of proportionality when managing risk, taking into account the scale, complexity and importance of ICT-related dependencies; and the risks arising from contractual arrangements, taking into account the criticality or importance of the respective service, process or function, and the potential impact on the continuity and quality of financial services and activities at individual and group levels;
• Adopt an ICT third-party risk strategy and review it regularly; and
• The principle that financial entities shall maintain and update at the entity, sub-consolidated and consolidated levels a register of information concerning all contractual arrangements with ICT third-party service providers.

Critical third-party providers

DORA introduces an oversight framework for critical ICT third-party providers (CTTP), outlining specific criteria for designating a third-party as critical. CTPPs will be charged a fee to cover oversight costs. The oversight framework includes the provision of a ‘lead overseer’ for each CTPP, who will have the power to:

• conduct general investigations and inspections and request documentation;
• request reports after the completion of oversight activities specifying the remediation actions taken;
• address recommendations towards ICT CTPPs on, for example, the use of conditions and terms to minimise possible systemic impact;
• impose a periodic penalty payment  to compel the CTPP to comply (a daily penalty of 1% of the prior year’s turnover for a maximum of six months); and
• request the termination of contractual arrangements with relevant firms if a CTTP opposes an inspection.

Information-sharing

DORA encourages financial entities to exchange among themselves cyber threat information and intelligence, including indicators of compromise, tactics, techniques, and procedures, cyber security alerts and configuration tools, to the extent that such information and intelligence sharing enhances the digital operational resilience of financial entities and is implemented through arrangements that protect the potentially sensitive nature of the information shared. The information-sharing arrangements should also define the conditions for participation, and financial entities must notify the competent authorities of their involvement in such information-sharing arrangements.

Technical standards

By July 2024, the final Regulatory Technical Standards and the Implementing Technical Standards will be published in relation to: 

• Incident management: reporting content for major ICT-related incidents and conditions under which an entity can delegate, on receipt of approval, reporting obligations to a service provider.

• Digital operational resilience: criteria for testing all critical applications at least yearly and requirements concerning the scope of threat-led penetration testing, testing methodology, approach, results, remediation and closure.

Third-party risk management: details on the content for policies in relation to contractual arrangements and the types of information to be included in the register of information.