DORA - Digital Operations Resilence Act

DIGITAL OPERATIONAL RESILIENCE ACT (DORA)

OK, now you know what DORA means, but what does it mean for your organisation?


DORA is a new European framework that focuses on embedding a more robust and resilient approach to delivering digital capabilities for financial entities.


This new legislation enacted by the EU to establish standardised security requirements across the financial sector. DORA requires qualifying financial firms and entities to prove their information and communication technology (ICT) systems are resilient and secure - according to a specific set of criteria and instructions.

I KNOW WHAT DORA IS, I JUST WANT TO TALK TO SOMEBODY

WHO DOES DORA AFFECT?

Financial entities and critical ICT service providers, including:


  • Banks
  • Investment firms
  • Electronic money institutions
  • Crypto-asset service providers
  • Trading venues and repositories
  • Insurance and insurance intermediaries
  • Digital and data services providers


DORA entered into force on 16th January 2023. With an implementation period of two years, financial entities will be expected to be compliant with the regulation by early 2025. Therefore DORA is enforced right now and there's no longer any excuse for noncompliance.

THE 5 PILLARS OF DORA

DORA sets the regulatory focus on 5 key pillars

ICT RISK

MANAGEMENT


Establish a comprehensive framework for managing ICT risks.

ICT-RELATED INCIDENT REPORTING


Develop a process to report ICT incidents using ESA-developed templates.

DIGITAL OPERATIONAL RESILENCE TESTING


Perform annual ICT testing to identify and eliminate risks.

ICT THIRD-PARTY RISK MANAGEMENT


Co-manage risk and ensure compliance of third-party ICT (cloud) providers.

INFORMATION SHARING ARRANGEMENTS


Share Cyber Threat information and insights.

WHAT ARE THE PENALTIES OF NON COMPLIANCE?

Non-compliant financial entities and ICT providers may face fines amounting to 1% of the provider’s average daily worldwide turnover in the previous business year. Those fines can be reimposed every day for up to six months or until compliance is achieved. 

AM I COMPLIANT? WHAT CAN I DO?

The first thing we suggest is to arrange a free consultation with Simplify IT to ascertain your situation and options. The grace period with DORA has now passed, so it's important not to delay if you have any concerns.


Simplify IT in can support you in building a DORA-complicit environment from end to end. Our professional services are tailored to meet your unique DORA-related needs, and our Ransomware Protection and Recovery services provide ongoing assessment and protection to ensure compliance.

GET IN TOUCH

If you're ready to discuss DORA, how it affects your organisation and what your options are, get in touch with us as soon as possible by filling out some details in the form provided.


Or give us a call on 0345 1243 441


Simplify IT is FSQS registered.

FSQS (Financial Services Qualification System) is a community of financial institutions including banks, insurance companies and investment services, providing a single standard for managing the increasing complexity of third and fourth-party information needed to demonstrate compliance to regulators, policies and governance controls.

Request a call back

Share by: