Blogs
The European Union’s (EU) DORA is designed to strengthen the operational resilience of financial institutions against disruptions, such as cyberattacks and system failures. However, compliance requirements also extend to information and communication technology (ICT) service providers dealing with financial institutions. With less than a month before DORA becomes enforceable, it’s vital that you act now.
SOME OF THE ORGANIZATIONS AFFECTED BY DORA
- Banks
- Investment firms
- Insurance companies
- Payment service providers
- ICT service providers for financial institutions
HIGHER RISK MANAGEMENT AND INCIDENT RESPONSE STANDARDS ARE COMING
DORA’s compliance requirements will help to safeguard consumers and protect the financial services sector. To further bolster the financial sector’s resilience, DORA supports the sharing of threat intelligence and incident data between financial institutions.
Here’s what financial institutions and third-party partners can expect when meeting DORA compliance:
Risk management frameworks
Organizations must implement robust ICT risk management frameworks to identify, prevent, detect and manage risks, including governance structures and risk-tolerance-based strategies.
ICT incident reporting
Organizations are required to report major ICT-related incidents using a standardized methodology, promoting transparency and supporting collective risks management.
Regular resilience testing
Organizations must conduct regular, mandated digital operational resilience testing, including threat-led penetration testing to ensure systems can withstand and recover from disruptions.
UNDERSTANDING DORA’S IMPACT ON YOU
DORA isn’t optional, it’s a mandatory framework that requires action, accountability and investment throughout your organization. Under DORA, boards of financial institutions will be held legally responsible for ICT risk management, and it’s set to become enforceable on January 17th 2025.
Implementation costs: Organizations must implement robust ICT risk management frameworks to identify, prevent, detect and manage risks, including governance structures and risk-tolerance-based strategies.
Resource drain: DORA will likely increase regulatory scrutiny, with regular reporting and testing likely requiring increased business resource allocation to achieve compliance.
Third-party compliance: Financial institutions will have to ensure third-party providers are also DORA compliant, which could impact the stringency of contracts and oversight.
ACHIEVE DORA COMPLIANCE WITH HIGHPOINT
It’s not too late to start planning for DORA. As a technology- and vendor-agnostic organization, we can tailor a solution that perfectly serves your unique ambitions. You’ll get the skills and solutions you need no matter where you are on your DORA journey, across people, policy and technology.
YOUR JOURNEY TO DORA COMPLIANCE
HAS NOT STARTED
HighPoint will work with you to structure DORA change programs across your technology and wider business to ensure compliance.
YOUR JOURNEY TO DORA COMPLIANCE
IS UNDERWAY
We will review and assess your existing implementation program, providing recommendations based on best practice.
YOU REQUIRE HANDS-ON IMPLEMENTATION SUPPORT
We can support you if you don’t have the internal skills, resource or bandwidth required to complete the technical work for DORA compliance.
GET UP TO SPEED WITH DORA’S FINER DETAILS
In our blog series, we outline everything you need to know about DORA. Whether you work in financial services or you are a service provider to the finance industry, this series of articles will help you understand the key principles of DORA and guide you through some of the expectations of the incoming legislation.
Ready to move forward and achieve DORA compliance? Wherever you are on your journey, our team is ready to support you with a comprehensive DORA assessment today.
