Digital operational resilience for the financial sector
DORA (REGULATION (EU) 2022/2554)
Regulation (EU) 2022/2554 on digital operational resilience for the financial sector was adopted on 14 December 2022 by the European Parliament and the Council of the EU and aims to prevent and mitigate the risk of cyber threats in the financial sector.
Regulation (EU) 2022/2554, often referred to as the Digital Operational Resilience Act (DORA), introduces a comprehensive framework to ensure the operational resilience of digital systems in the financial sector. Organizations subject to this act are expected to perform various actions to comply with the requirements. The key aspects include:
1. ICT Risk Management Framework:
- Establish and maintain a thorough risk management framework for Information and Communication Technologies (ICT).
- Identify, categorize, and assess ICT-related risks.
- Implement protective and preventive measures to mitigate identified risks.
- Regularly review and test the effectiveness of the ICT risk management framework.
2. Incident Reporting:
- Establish robust mechanisms to detect and manage ICT-related incidents.
- Report significant ICT-related incidents to the relevant authorities in a timely and efficient manner.
3. Digital Operational Resilience Testing:
- Conduct regular testing to assess the resilience of ICT systems and processes.
- Perform vulnerability assessments, scenario-based testing (e.g., penetration testing), and establish a process for identifying and mitigating vulnerabilities.
4. ICT Third-Party Risk Management:
- Manage and monitor the ICT third-party risk, especially when relying on critical ICT third-party service providers.
- Ensure contracts with third-party service providers include robust clauses on service levels, data protection, and audit rights.
- Establish mechanisms to monitor the performance and compliance of third-party service providers.
5. Information Sharing:
- Engage in information sharing regarding ICT risks and incidents to enhance industry-wide understanding and management of ICT threats.
- Participate in information-sharing platforms while ensuring the protection of sensitive and confidential information.
6. Oversight and Compliance:
- Adhere to the oversight framework established by competent authorities.
- Regularly assess compliance with the regulation and cooperate with regulatory reviews and audits.
- Implement corrective actions as required by regulatory authorities to address deficiencies or non-compliance issues.
7. Management Body's Involvement:
- Ensure that the organization's management body is effectively engaged in the oversight of the ICT risk management framework.
- Require regular reporting to the management body on ICT risks, incidents, and resilience measures.
8. Resilience Testing and Cybersecurity:
- Implement a robust cybersecurity strategy to protect against cyber threats.
- Conduct resilience testing, including advanced testing for significant entities, to evaluate the organization's ability to effectively respond to and recover from ICT disruptions.
9. Resources and Expertise:
- Allocate sufficient resources (financial, human, technical) to ICT risk management and operational resilience measures.
- Ensure staff are adequately trained and maintain a high level of expertise in ICT risk management and operational resilience.
Organizations subject to DORA are required to integrate these practices into their operational and risk management strategies to ensure the stability and resilience of their ICT systems and the broader financial market infrastructure. Compliance with these requirements will be monitored by relevant authorities, and organizations may be subject to audits, assessments, and corrective measures if deficiencies are identified.
Regulation (EU) 2022/2554 shall apply from 17 January 2025.
Regulation (EU) 2022/2554 - EUR-Lex (europa.eu)
Digital operational resilience for the financial sector
Implementation of management standards
CONSEJO Ltd. is a consulting company with over 20 years of practical experience in the development, implementation and maintenance of management systems in accordance with international standards and regulatory requirements. The company provides consulting services in the areas of quality management, environmental management, occupational health and safety, food safety, information security, cybersecurity, risk management and sustainable development. Our expertise covers standards and schemes such as ISO 9001, ISO 14001, ISO 45001, ISO 22000, ISO/IEC 27001, IFS Food, BRCGS and HACCP, as well as consulting services related to NIS2, DORA, GDPR and EcoVadis.
The CONSEJO team has been involved in over 1,500 projects for organizations across various sectors of the economy, including manufacturing, construction, energy, information technology, transport, trade, the food industry and services. Our approach focuses on developing management systems that work effectively in practice, tailored to the specific characteristics and needs of each organization. We work closely with our clients, providing consulting support, staff training and assistance during implementation. We strive to deliver high-quality services within the agreed deadlines and solutions that support successful certification and create long-term value for businesses.
