DORA: Compliance With The EU Digital Resilience Act

The EU’s Digital Operational Resilience Act (Regulation (EU) 2022/2554) is a significant development in how the Bloc regulates finance. The deadline for complying with the EU’s new DORA regulation is fast approaching.

But what exactly is DORA, and what are the risks associated with non-compliance?

What Is DORA?

Currently, financial institutions manage the main operational risk categories via capital allocation. The difference post-DORA is that they will now be expected to manage all areas of operational resilience and adhere to a set of rules around protecting, detecting and containing ICT-related threats. 
 
DORA also sets out rules explicitly pertaining to ICT risk management, incident reporting, operational resilience testing and third-party risk monitoring. Within the regulation is the acknowledgement that such incidents and a lack of preparedness for them have the potential to impact the entire financial system in a major way – this is despite a “sufficient” level of capital for traditional risk assessments. 
 
Why Is DORA Important?
 
The main objective of DORA is to ensure all parties involved in the European financial system have adequate protection against cyber-attacks and other data-related risk factors. Part of this will require organisations to prove their resilience against various ICT-related threats.
 
Many of the finer technical details are still being finalised by local regulators. However, some key areas where DORA will impact have already been identified. These include:  

•    Risk Management
•    Incident Reporting
•    Testing and Scenario Analysis
•    Outsourcing Assessment
•    Supervision   

As a result, cyber-attacks – such as the recent event at Capita, should be avoided. In March 2023, Capita experienced a security breach that compromised its pension fund, with members being informed that their data had been stolen. The attack on the outsourcer’s administration services led to multiple private sector pension funds being affected.

The Problem

As promising as this sounds, there are inevitably some issues. All financial entities operating in the EU have a deadline of 17th January 2025 to be DORA-compliant – less than 18 months away. Time is of the essence here, as ISMS.online’s recent “The State of Information Security” report highlights. Drawing from 500 UK infosec professionals representing managers, directors and C-level executives, the average company takes 15.5 months to align its operations with any given regulation fully. 
 
Although the survey also found that just 27% of companies say they are struggling to comply with the regulation, this time window suggests otherwise. 
 
The Solution
 
Apart from the external pressure of deadlines, companies should be motivated to comply. One reason is that strong cyber-security, far from being a burden, is a significant competitive asset for any organisation. In today’s digital, fast-paced business environment, ensuring sound information security, data privacy, and cybersecurity is becoming ever more vital to the success and longevity of a business. 
 
To this end, smart, forward-thinking business leaders are mobilising their people and various software to place information security at the heart of the organisation. In doing so, they are positioning themselves ahead of their competition in multiple ways. 
 
One crucial benefit is the increased confidence stakeholders have in the business. Staff, customers and decision-makers can leverage this “digital trust” to seize new opportunities unavailable to those without superior information security. This increased level of trust will, in turn, accelerate regulatory compliance. 
 
Conversely, businesses that do not invest in this will have to deal with increased cyber-attacks, potentially deadly costs to finances and reputation. Worse still, the scope of cybercriminal activity is only becoming wider as we increase our reliance on data and cloud services. The result is a rise in industrial-scale cybercrime, as nefarious actors operate as businesses.
 
Safeguarding Future Prosperity 
 
As the deadline for DORA compliance draws closer, businesses must step up infosec investment to ensure they meet it on time. So, how does a business start making the transition?

It all begins with investments into the right technology, processes, and people that will ensure businesses have all they need to deliver a swift, effective counter to any inbound cyber threats and ensure regulatory compliance. 
 
But this cannot be achieved unless members of the organisation are well-informed. In the event of a crisis, employees are the first line – and often strongest – of defence and understand the role they have to play in safeguarding data and critical assets. Crucially, senior members of the organisation must demonstrate sound leadership and communication skills to establish a robust security culture.

Investing in this training and infrastructure today is the best way to ensure consistent, future-proof growth tomorrow.

Christopher Gill is Governance, Risk Management, Compliance and Audit Specialist at ISMS.online  

Image: Peter Linforth

You Might Also Read: 

Imminent: Cybersecurity Regulations For US Financial Services:

___________________________________________________________________________________________

If you like this website and use the comprehensive 6,500-plus service supplier Directory, you can get unrestricted access, including the exclusive in-depth Directors Report series, by signing up for a Premium Subscription.

  • Individual £5 per month or £50 per year. Sign Up
  • Multi-User, Corporate & Library Accounts Available on Request

Cyber Security Intelligence: Captured Organised & Accessible


 

« Understanding Malvertising Attacks
Beyond Traditional Security »

Infosecurity Europe
CyberSecurity Jobsite
Perimeter 81

Directory of Suppliers

Alvacomm

Alvacomm

Alvacomm offers holistic VIP cybersecurity services, providing comprehensive protection against cyber threats. Our solutions include risk assessment, threat detection, incident response.

Directory of Cyber Security Suppliers

Directory of Cyber Security Suppliers

Our Supplier Directory lists 7,000+ specialist cyber security service providers in 128 countries worldwide. IS YOUR ORGANISATION LISTED?

North Infosec Testing (North IT)

North Infosec Testing (North IT)

North IT (North Infosec Testing) are an award-winning provider of web, software, and application penetration testing.

ManageEngine

ManageEngine

As the IT management division of Zoho Corporation, ManageEngine prioritizes flexible solutions that work for all businesses, regardless of size or budget.

Infosecurity Europe, 3-5 June 2025, ExCel London

Infosecurity Europe, 3-5 June 2025, ExCel London

This year, Infosecurity Europe marks 30 years of bringing the global cybersecurity community together to further our joint mission of Building a Safer Cyber World.

Centre for International Governance Innovation (CIGI)

Centre for International Governance Innovation (CIGI)

CIGI research areas include Conflict Management & Security which encompass cyber security and cyber warfare.

Brit

Brit

Brit PLC is a market-leading global specialty insurer and reinsurer, focused on underwriting complex risks including cyber, privacy and technology.

ISACA Conferences

ISACA Conferences

ISACA is dedicated to offering the most dynamic and inclusive conferences to keep you abreast of the latest advances in IT and Information Security.

Averon

Averon

Averon's technology is the new gold standard for digital identity - the easiest, fastest and most secure verification solution for users on both WiFi and LTE.

Intelligent Waves

Intelligent Waves

Intelligent Waves holds and manages contracts to provide an array of intelligence, operational, communications and IT support to the USG in austere, forward-deployed, hazardous duty environments.

Horangi

Horangi

Horangi provides security products and services that enable the rapid delivery of Incident Response and threat detection for our customers who lack the scale, expertise, or time to do it themselves.

Jerusalem Venture Partners (JVP)

Jerusalem Venture Partners (JVP)

JVP’s Center of Excellence in Be’er Sheva aims to identify, nurture and build the next wave of cyber security and big data companies to emerge out of Israel.

TriagingX

TriagingX

TriagingX successfully created the first generation malware sandbox that is being used by many Fortune 500 companies for daily malware analysis.

Content+Cloud

Content+Cloud

Content+Cloud is a leading technology services business and Managed Services Provider (MSP) with a genuine passion for helping your organisation to succeed, whatever your ambitions.

Battery Ventures

Battery Ventures

Battery partners with talented founders and teams building category-defining businesses at all stages of growth.

Esprinet

Esprinet

The Esprinet Group is an enabler of the technology ecosystem: a team of people who promote access to technology through an extensive network of professional resellers.

SecureTeam

SecureTeam

SecureTeam are a UK-based information security practice, specialising in all areas of cybersecurity.

Buzz Cybersecurity

Buzz Cybersecurity

Buzz Cybersecurity systems and services are designed to proactively guard against common and uncommon cyber threats.

North Infosec Testing (North IT)

North Infosec Testing (North IT)

North IT (North Infosec Testing) are an award-winning provider of web, software, and application penetration testing.

modePUSH

modePUSH

modePUSH is a cybersecurity company focused on end-to-end breach response from Digital Forensics to Restoration across the enterprise and cloud environments.

Sinergi Digital

Sinergi Digital

Sinergi Digital is a business unit of the Metrodata Group with a focus on providing ICT solution to help accelerating digital transformation.