DORA: A New Horizon of Digital Resilience for UK Financial Firms

Copy URL
29th February 2024

The Digital Operational Resilience Act (DORA) represents a groundbreaking legislative framework introduced by the European Union, designed to bolster the operational resilience of the financial sector against a backdrop of increasing digital threats and ICT disruptions. Published in the Official Journal of the European Union on 27 December 2022, DORA represents a comprehensive framework aimed at ensuring that the financial sector's digital operations can withstand, respond to, and recover from cyber incidents and ICT-related disruptions. Despite Brexit, UK financial firms and their ICT service providers that have operations in the EU or contractual obligations with EU-based financial entities fall under DORA's broad jurisdiction. This development needs a recalibration of their operational resilience measures to meet DORA's strict criteria.

Who does DORA apply to?

DORA is specifically crafted to encompass a broad spectrum of entities within the financial sector of the European Union, reflecting the interconnected nature of modern financial services and the digital infrastructure that supports them. DORA’s reach extends across traditional financial institutions to emerging financial services, ensuring comprehensive coverage of the financial sector's digital operational resilience. Here’s a breakdown of the firms and sectors directly impacted by DORA:

  • Banks and Credit Institutions: Entities accepting deposits and offering credits.
  • Investment Firms: Companies providing investment services or performing investment activities.
  • Insurance Companies: Including life and non-life insurers, as well as reinsurance firms.
  • Payment Institutions and Electronic Money Institutions: Firms facilitating electronic payments and issuing electronic money.
  • Central Securities Depositories and Central Counterparties: For securities settlement and clearing.
  • Trading Venues: Such as stock exchanges and trading platforms.
  • Alternative Investment Fund Managers and UCITS Management Companies: Managers of investment funds.
  • Crypto-Asset Service Providers: Including platforms for cryptocurrency transactions.
  • Crowdfunding Platforms: Services facilitating funding for projects or businesses.
  • Credit Rating Agencies and Data Reporting Service Providers: Entities evaluating credit risk and reporting financial data.
  • ICT Third-Party Service Providers: While not financial entities themselves, ICT third-party service providers to the financial sector are also significantly impacted by DORA. These include cloud services providers, IT infrastructure managers, and software-as-a-service (SaaS) platforms that play a critical role in the financial sector’s operational infrastructure.

Why DORA Matters to UK Firms

For UK firms, navigating the post-Brexit landscape entails adjusting to regulatory divergences between the UK and the EU. Yet, DORA underscores the crucial interconnectedness of modern financial markets and the significance of ensuring operational compliance beyond geographical boundaries. UK financial entities with EU market involvement — whether directly or through third-party relationships — must align their operational practices with DORA's comprehensive requirements to maintain market access and uphold service integrity.

Understanding DORA's Key Requirements

In the dynamic landscape of financial services, DORA stands as a critical regulatory framework aimed at strengthening the sector's ICT resilience. This legislation encompasses a broad spectrum of requirements meticulously designed to ensure that financial entities can withstand and swiftly recover from ICT disruptions. Below is an enhanced outline of the pivotal DORA requirements, structured to offer clarity and actionable insights for entities navigating this regulatory terrain.

  • ICT Risk Management Excellence (Articles 5 to 16): Emphasises leadership accountability in overseeing ICT resilience. It outlines a comprehensive risk management framework, including identification, protection, detection, response, and recovery phases, with an emphasis on continuous learning, evolution, and effective crisis communication.
  • ICT-Related Incident Mastery (Articles 17 to 23): Establishes a clear framework for the management, classification, and mandatory reporting of ICT-related incidents. This ensures a proactive stance in incident resolution and communication.
  • Digital Operational Resilience Testing (Articles 24 to 27): Mandates a thorough testing programme that emphasises technical assessments to evaluate the resilience of digital operations. It requires large-scale threat testing by independent testers every three years, introducing standardised classification and compulsory anonymised reporting of incidents to enhance transparency and collective learning across the EU financial sector.
  • ICT Third-Party Risk Management (Articles 28 to 44): Advocates for a strategic approach to ICT third-party risk, including the development of policies and a standardised register of information. It sets guidelines for pre-contract assessments, detailed contract contents, termination procedures, and strategies for stressed exits, encouraging meticulous due diligence processes and information-sharing arrangements to manage third-party risks effectively. Proactive Information Sharing (Article 45): Promotes an environment where entities are encouraged to share threat information and intelligence, fostering a community of resilience and mutual support.

Timeline for DORA Implementation

DORA sets a clear timeline for firms within the EU and those UK entities operating in European financial markets to bolster their operational resilience. Here are the essential milestones:

  • Publication Date: DORA was published in the Official Journal of the European Union on 27 December 2022, marking the formal introduction of the regulation.
  • Effective Date: The regulation officially took effect on 16 January 2023, starting the clock on the compliance timeline.
  • Compliance Deadline: Financial entities must fully comply with DORA by 17 January 2025. This period allows firms to adjust their operational and cybersecurity practices to meet DORA 's stringent requirements.

Leveraging Cybersecurity Consultancy for DORA Compliance

To ensure compliance with DORA, financial companies should consider engaging with cybersecurity specialists for the following services:

  • Risk Assessment and Management: Comprehensive evaluations to identify and manage ICT risks in line with DORA requirements. This includes establishing a risk management framework that encompasses identification, protection, detection, response, recovery, and continuous learning from ICT-related incidents.
  • Digital Operational Resilience Testing: Implementation of a structured testing program, including penetration testing and vulnerability assessments, to evaluate the resilience of ICT systems against disruptions and cyber threats. This should align with DORA ’s stipulations for regular and rigorous testing.
  • Incident Management and Reporting: Assistance in developing and refining procedures for managing and classifying ICT-related incidents, ensuring timely and compliant reporting of such incidents to relevant authorities. This includes the creation of effective crisis communication strategies.
  • Third-Party Risk Management: Guidance on managing risks associated with ICT third-party service providers, including conducting due diligence, negotiating contracts that align with DORA ’s standards, and planning for the termination of contracts and stressed exits.
  • Compliance Audits and Gap Analysis: Conduct audits to assess current practices against DORA ’s requirements, identify gaps, and provide actionable recommendations to achieve compliance.
  • Regulatory Advisory Services: Expert advice on the interpretation of DORA regulations and how they apply to specific operations, including updates on regulatory changes and how they impact compliance efforts.
  • Training and Awareness Programs: Design and deliver training sessions to enhance the cyber security knowledge and awareness of all staff members, ensuring they understand their role in maintaining operational resilience.
  • Information Sharing Frameworks: Assistance in establishing frameworks for sharing information on cyber threats and vulnerabilities with peers and industry bodies, as encouraged under DORA, to enhance sector-wide resilience.
  • Strategic Cyber Security Consulting: Strategic advice on aligning cyber security efforts with business objectives, ensuring that investments in cyber security provide the maximum benefit in terms of resilience and compliance.

The Need for Specialised Cyber Security Consultancy

Navigating DORA's intricacies, especially for companies without in-house cyber security, highlights the importance of working with a specialised cyber security company. A consultant with a focus on strategic consulting rather than specific tools or technology can provide tailored solutions based on an entity's unique risk profile, operational dynamics, and regulatory duties. At 2&20, we are working with firms impacted by DORA to select the most qualified and best consultancies to deliver DORA compliance checks and DORA resilience programmes, and we will be happy to recommend those we find adhering to best practices.

A specialised cyber security consulting firm delivers a comprehensive awareness of the financial sector's regulatory structure, as well as competence in cutting-edge cyber security procedures. This dual skill is critical for transforming DORA's legal mandates into practical, successful cybersecurity solutions. This collaboration can help UK firms understand DORA 's standards, streamline the compliance journey, and embed resilience into their operations. Creating strategic advantages that go beyond compliance.