Digital Operational Resilience Act (DORA)

What is DORA?

The digital Operational Resilience Act (DORA) is a regulatory framework introduced by the European Union to ensure operational resilience of financial entities.

Who needs to comply with DORA? (Art.2)

Banks and credit institutions
Payment institutions
Investment firms
Insurance companies
Other financial entities in the EU financial sector
Critical third-party service providers that provide ICT-related services to the above financial entities

Fig. 1: Objectives of DORA

Why DORA?

Strengthen ICT security of financial entities.
Harmonizes rules on operational resilience.
Financial entities are increasingly dependent on technology.
Cyber threats are increasing in number and in complexity

Why Probability?

Combination of knowledge from experience with various types of institutions and specific ICT knowledge.
Probability strives for feasible solutions and implementations that fit the size and risk attitude of the organization.
Providing insight into ICT risks is paramount to enable adjustments by the board/management.
Implementation, risk assessment, or audit.

RTS Contents

The table below shows the content of both batches of RTS’s according to the five pillars of DORA.

ICT risk management framework

Content

Key principles |& requirements on ICT risk management framework
ICT framework reviewed periodically and after incident

Relevant Publications

RTS on the ICT risk management framework (Art. 15)
RTS on the simplified ICT Risk management framework (Art. 16.3)
Guidelines for estimating aggregated cost/losses, due to serious ICT-related incidents (Art. 11.11)

ICT incident mgmt., classification & reporting

Content

Harmonizes ICT incident reporting, extends scope, allows voluntary cyber threat reporting
Adds incident management process requirements

Relevant Publications

RTS on the classification of ICT related incidents and cyber threats (Art. 18.3)
RTS on the content of reports on serious ICTD-related incidents (Art. 20.a)
ITS on reporting details for reporting a serious ICT-reltaed incident (Art. 20.b)
Feasibility report on further centralization of incident reporting through the esteablishment of a single EU hub for major ICT-related incident reporting (Art. 21) (Submission to the European Commission from 16 Jan 2025)

Digital operational resilience testing

ICT third-party risk framework

Content

Rules for third-party ICT risk management and contracts
EU oversight of critical ICT third-party providers

Relevant Publications

ITS with standard templates for information registers (Art. 28.9)
RTS on the specification of the use of ICT services of ICT third party service providers (Art. 28.10)
RTS on contracting out support of critical or important functions to ICT third-party related services (Art. 30.5)

Information sharing

Content

Enhances resilience via voluntary cyber threat information sharing among financial entities

Relevant Publications

EBA seeks ESA’s views on critically criteria (Art. 31.2) and oversight fees (Art. 43.2) (Delivered on September 30th, 2023, and legal act on July 17, 2024)
Guidelines Cooperation ESA with authorities for supervision (Art. 32.7)
RTS on harmonization of monitoring (Art. 41)

DORA Timeline

The timeline shows the regulatory publications for both DORA and DNB Good Practice Information security, while the bottom timeline shows supervisory activities of DNB. There are still two upcoming publications around DORA. This includes the second batch of regulatory technical standards (RTS) slated for July 17, as well as a feasibility report scheduled for January 17, 2025.

Fig. 2: DORA Timeline

Partnering with Probability & Partners

Partnering with Probability & Partners means choosing a future where technology is not just an enabler but a driver of success. It’s about redesigning the architecture of your modeling landscape and systems, creating a cohesive ecosystem that propels your institution ahead of the curve. Contact us for a consultation, and together, we’ll transform your technological infrastructure into a dynamic, integrated system that drives your operations to excellence.

Maurits van den Oever

Quantitative Consultant

Mail
Phone

Pim Poppe

Managing Partner

Mail
Phone

Insights

November 19, 2024

Digital Operational Resilience Act (DORA)

What is DORA?

Who needs to comply with DORA? (Art.2)

Why DORA?

Why Probability?

RTS Contents

Content

Relevant Publications

Content

Relevant Publications

Content

Relevant Publications

Content

Relevant Publications

Content

Relevant Publications

DORA Timeline

Partnering with Probability & Partners

Maurits van den Oever

Pim Poppe

Insights

Edward Roozenburg: DORA, are you ready yet?

Prepare for DORA

Maurits van den Oever: DORA, the final (cybersecurity) frontier

Amba Zeggen: DORA is chefsache

De tijdlijn voor Good Practice Informatiebeveiliging en DORA

DORA en DNB Good Practice Informatie Beveiliging 2019 en 2023

Edward Roozenburg: DORA, een nog onduidelijke finish

Edward Roozenburg: Datalekken, bangmakerij of reëel risico?

Visiting Address

Postal address

Information

Contact Sector Leads