How the Digital Operational Resilience Act applies to financial entities and how to prepare for it

As the digital landscape continues to evolve, businesses operating in Europe must be prepared to adapt to new regulations aimed at securing their digital infrastructure. One such piece of legislation is the Digital Operational Resilience Act (DORA), which has applied since January 17, 2025. This comprehensive and far-reaching act has significant implications for financial entities and the ICT third-party service providers that support them, making it crucial for organizations to understand its requirements and take the necessary steps to ensure compliance.

Complying with DORA is not just a legal requirement; it also serves as an indicator of an organization's commitment to maintaining robust digital infrastructures and safeguarding customer data. By adhering to DORA's guidelines, businesses can improve their overall operational resilience, reduce the risk of cyberattacks and protect their reputation in the market.

What is the Digital Operational Resilience Act (DORA)?

DORA is Regulation (EU) 2022/2554, the European Union's rulebook for the digital operational resilience of the financial sector. It lays down uniform requirements on the security of the network and information systems that support the business processes of financial entities, with the aim of achieving "a high common level of digital operational resilience" (Article 1). It has applied since January 17, 2025 (Article 64).

The regulation defines digital operational resilience as "the ability of a financial entity to build, assure and review its operational integrity and reliability", including through disruptions and where ICT third-party service providers supply the capabilities (Article 3(1)). ICT stands for information and communication technology.

Article 2 lists the entities in scope, including credit institutions, payment institutions, investment firms, insurance and reinsurance undertakings and ICT third-party service providers. Some entities are excluded, so check Article 2 against your own entity type.

Key requirements of DORA

There are five key pillars that DORA is built upon, which are:

ICT risk management requirements

Organizations must implement a comprehensive risk management framework to identify, assess and mitigate potential risks to their digital infrastructure. This includes regularly reviewing and updating risk assessments, implementing adequate controls and maintaining a robust incident response plan.

ICT-related incident response

Businesses must establish a clear and effective incident response plan that outlines the steps to be taken in the event of a cyber incident. This includes identifying key personnel responsible for managing the incident, establishing communication channels and defining procedures for escalation and resolution, which benefits employees at all levels of an organization.

Digital operational resilience testing

It is a requirement for organizations to periodically test their risk management framework for preparedness and to aid the identification of any potential weaknesses within the framework. This testing is proportionate and dependent on the size, business and risk profiles of each financial entity.

Managing ICT third-party risk

DORA places strict requirements on the outsourcing of critical functions, with businesses expected to maintain a high degree of oversight and control over third-party service providers. Businesses must identify and address any operational risks arising from their reliance on third-party providers, including potential disruptions to services and data breaches. This requires implementing robust controls and monitoring mechanisms to ensure the ongoing security and resilience of these relationships.

Information sharing

The regulation also allows financial entities to create arrangements to exchange information among themselves relating to cyber threat information and intelligence.

Impact on larger and smaller businesses

While larger organizations may already have some measures in place to address digital operational resilience, DORA's requirements are likely to necessitate additional investments in technology, processes and personnel.

For smaller businesses, the impact may be more pronounced, as they may need to build their resilience capabilities from the ground up.

How to prepare for DORA today

To ensure that businesses are prepared for DORA, there are several steps that businesses can take.

• Conduct a thorough assessment of their current digital infrastructure, to identify gaps and vulnerabilities that need to be addressed.
• Develop and implement a comprehensive risk management framework, that incorporates DORA's requirements into their existing processes.
• Establish a clear incident response plan, that ensures all relevant personnel are trained and aware of their responsibilities.
• Review and update current outsourcing arrangements, ensuring that third-party providers meet DORA's standards for operational resilience.

In addition, businesses can use modern technology solutions, such as Ideagen Risk Management, to help minimize risks and assist in compliance.

Confirm your scope, then keep risk, incident and supplier controls up to date

The regulation has applied since January 2025, so preparation now means acting on what it asks. The first step is to check Article 2 against your own entity type, then assess your digital infrastructure against the five pillars of risk management, incident response, resilience testing, third-party oversight and information sharing. Larger firms may be building on measures already in place, while smaller firms may need to start from the ground up. Either way, the practical task is to keep your risk assessments, incident plans and supplier arrangements reviewed and up to date.