Navigating DORA: Protecting Financial Businesses in the Digital Era

DORA, also known as the Digital Operational Resilience Act, started its effect on January 16, 2023. However, financial organisations have time until January 2025 to make sure they follow the rules and become compliant.

DORA sets up rules that every company, whether in the EU or not, has to follow if they’re part of the EU financial services industry. These rules make sure that businesses can handle and recover from any problems or threats related to their digital systems

It will shift the focus from solely ensuring financial soundness to also guaranteeing resilient operations in the face of severe disruptions caused by cybersecurity and information and communication technology (ICT) issues.

With public cloud spending expected to climb, it has become crucial for regulators to recognise the growing use of cloud services in the financial sector. The belief that important financial data wouldn’t be stored on the cloud is changing. Studies from Gartner, emphasise the necessity of putting measures in place to handle the substantial amount of data stored in the cloud, with a focus on managing third-party relationships for financial service companies.

The introduction of the Digital Operational Resilience Act (DORA) brings both opportunities and responsibilities for financial institutions. Understanding the implications of inaction and the need for proactive measures is paramount for business leaders.

1. Financial Industry Challenges and Implications:

Financial entities, especially small and medium-sized banks, are urged to embrace digitalisation cautiously. DORA introduces central oversight of cloud service providers, offering an advantage for banks relying on these services. However, the challenges lie in the auditing of systemically important third-party service providers. With many cloud services operating globally and handling vast amounts of data, smaller European banks find it challenging to conduct comprehensive audits.

The financial sector faces substantial costs due to operational incidents, ranging from €2 billion to €27 billion per year for the EU financial sector. DORA aims to mitigate these costs and minimise the impact of serious cyber incidents by providing a regulatory framework that enhances digital operational resilience.

2. Implications for Business Owners:

For business leaders in the financial sector, overlooking DORA compliance or adopting an excessively high risk appetite poses severe consequences. Non-compliance with DORA regulations can result in penalties and regulatory actions. Furthermore, failure to implement the recommended resilience measures exposes financial entities to significant operational disruptions caused by cyber threats and ICT issues.

An overly ambitious risk appetite increases vulnerability to financial losses, damages reputation, and erodes customer trust. In the event of a cyber incident, the ability to maintain operations becomes challenging, potentially leading to financial instability.

Business leaders are urged to assess and manage their risk appetite diligently, aligning it with the regulatory framework established by DORA. Proactive adherence to these guidelines is fundamental for maintaining a resilient and secure digital infrastructure, ultimately safeguarding financial businesses against potential financial and operational risks in the dynamic digital landscape.

Current Situation for Finance Businesses:

DORA introduces a unified supervisory approach for a wide range of financial market participants, including credit institutions, payment providers, investment firms, insurance companies, and others. It applies to over 22,000 financial entities and ICT service providers operating within the EU, introducing specific requirements for consistent ICT risk management, resilience testing, and third-party risk management.

Impact to Business and Personal Accountability:

The five key topics at the core of DORA are ICT Risk Management, ICT-related Incident Management, Classification & Reporting, Digital Operational Resilience Testing, ICT Third Party Risk Management, and Information Sharing Arrangements. The regulation also establishes a Union-wide Oversight Framework for critical ICT third-party providers, emphasizing personal accountability in adhering to these requirements.

Consequences of Non-Conformity:

DORA entered into force on January 16, 2023, with an implementation period of two years. Financial entities are expected to achieve compliance by early 2025. The regulation is prescriptive, setting forth specific requirements that must be adhered to. Non-conformity may result in penalties or regulatory actions. For UK entities, DORA goes beyond existing operational resilience regulations and requires prompt action to determine if they fall within its scope.

Operational Resilience Program and DORA:

For entities with ongoing Operational Resilience programs, DORA represents both a challenge and an opportunity. Common elements exist between the UK Operational Resilience regulation and DORA, such as the identification of Important Business Services, mapping of dependencies, and scenario testing. Entities can leverage existing elements of their Operational Resilience program to address certain DORA requirements.

Impact on ICT Service Providers:

The rules covered in DORA cover elements like managing ICT risks, handling incidents, testing digital resilience, managing risks with third parties, and sharing information.

ICT providers will have to make sure their contracts follow DORA’s requirements, and if they don’t, there could be consequences from regulators.

In short, DORA has big effects on financial companies and ICT service providers. It means they need to be proactive about following the rules to keep digital operations strong and secure in the European Union.

Simplify Your Path Ahead: Navigate the Cyber Security Compliance Landscape

Our team has the know-how to help you meet your organisation’s Cyber resilience goals. We’ve helped many other financial enterprises with similar challenges, so we understand how it all fits together.

We’ll help you handle cybersecurity in a straightforward way. Redefine how you deal with risks, and together, we’ll make sure your digital world is secure and thriving.

We can work with your IT and Tech risk teams to keep things running smoothly. We’ll keep your business running as it should with minimum impact to people and processes.

Get In touch With Us Today.