Digital resilience in finance
Short label: DORA
Meaning
DORA addresses digital operational resilience in covered financial entities, with requirements concerning systems, incidents, testing and technology suppliers.
Why it matters
A financial organisation and its supplier may have different responsibilities under the rules and their contract.
What you can do
Identify your role, relevant systems and supplier agreements. Keep incident records separate from the register of contracts and service providers.
Services that can help
Device Shield and Web App Shield provide security capabilities and event records. They support relevant work but do not replace the organisation’s full DORA programme.
Official reference — DORA Art. 9–11
1. For the purposes of adequately protecting ICT systems and with a view to organising response measures, financial entities shall continuously monitor and control the security and functioning of ICT systems and tools and shall minimise the impact of ICT risk on ICT systems through the deployment of appropriate ICT security tools, policies and procedures.
— Regulation (EU) 2022/2554 (DORA), Art. 9(1)
1. Financial entities shall have in place mechanisms to promptly detect anomalous activities, in accordance with Article 17, including ICT network performance issues and ICT-related incidents, and to identify potential material single points of failure.
— Regulation (EU) 2022/2554 (DORA), Art. 10(1)
1. As part of the ICT risk management framework referred to in Article 6(1) and based on the identification requirements set out in Article 8, financial entities shall put in place a comprehensive ICT business continuity policy, which may be adopted as a dedicated specific policy, forming an integral part of the overall business continuity policy of the financial entity.
— Regulation (EU) 2022/2554 (DORA), Art. 11(1)
Covered financial entities must protect information and communication technology systems, detect unusual activity and maintain response and recovery arrangements. Supplier contract duties and critical-provider oversight are distinct questions.
Read the article on EUR-Lex → · Official text, quoted from the Official Journal of the EU
Acronyms used here: NIS2, GDPR, DORA, CRA
- NIS2 — Network and Information Systems Directive 2
- An EU cybersecurity directive with requirements for organisations covered by its scope.
- GDPR — General Data Protection Regulation
- The EU regulation on personal-data protection. RGPD is the French name and AVG the Dutch name.
- DORA — Digital Operational Resilience Act
- EU rules on digital operational resilience in the financial sector.
- CRA — Cyber Resilience Act
- EU cybersecurity rules for products with digital elements, including certain software and connected devices.