The Digital Operational Resilience ACT (DORA)

DORA is the European Regulation on digital operational resilience for the financial sector. Its purpose is to make the financial sector more resilient against cyber threats and ICT risk. To this aim, the Regulation introduces specific ICT-related requirements for financial entities and enables the European Supervisory Authorities, the ESAs, to supervise how financial entities manage ICT risk.



Intro

We start off by introducing some key points:

1 - European Supervisory Authorities or ESAs:

2 - "Critical or important functions of the financial entity"

‘critical or important function’ means a function, the disruption of which would materially impair the financial performance of a financial entity, or the soundness or continuity of its services and activities

Article 2

3 - Entry into force and application of DORA

The DORA Regulation entered into force on 16 January 2023 and will apply starting from 17 January 2025.

4 - Text

REGULATION (EU) 2022/2554 on digital operational resilience for the financial sector.


ICT risk management

The first set of requirements concerns the management of ICT risk: financial entities are required to:

  1. set up an ICT risk management framework which enables them to address ICT risk quickly, efficiently and comprehensively and to ensure a high level of digital operational resilience (Articles 5-15).
  2. review the ICT risk management framework
    • once a year, or only periodically for microenterprises;
    • in occasion of major ICT-related incidents;
    • following supervisory instructions or conclusions derived from relevant digital operational resilience testing
  3. assign the responsibility for managing and overseeing ICT risk to a control function and ensure an appropriate level of independence of such control function.

The ICT risk management framework shall include at least strategies, policies, procedures, ICT protocols and tools that are necessary to duly and adequately protect all information assets and ICT assets, including computer software, hardware, servers, as well as to protect all relevant physical components and infrastructures.

Article 6 (2)

The ICT risk management framework also includes a digital operational resilience strategy which outlines how the framework will be implemented.

Simplified ICT risk management framework

For some financial entities, article 16 provides for a simplified ICT risk management framework, which is made of a limited set of requirements, like the following:

  • put in place measures aimed at a quick, efficient and comprehensive management of ICT risk, including for the protection of relevant physical components and infrastructures;
  • continuously monitor the security and functioning of all ICT systems;
  • identify key dependencies on ICT third-party service providers;: which providers are crucial for the financial entity and its services.
  • ensure the continuity of critical or important functions, through business continuity plans and response and recovery measures, which include, at least, back-up and restoration measures

The simplified risk management framework is accessible to the following financial entities, for reasons associated with their size or the services they provide:

  • small and non-interconnected investment firms
  • payment institutions exempted pursuant to Directive (EU) 2015/2366;
  • institutions exempted pursuant to Directive 2013/36/EU in respect of which Member States have decided not to apply the option referred to in Article 2(4) of this Regulation;
  • electronic money institutions exempted pursuant to Directive 2009/110/EC;
  • small institutions for occupational retirement provision.

Update

The Commission Delegated Regulation EU n° 2024/1774 regulatory technical standards specifying ICT risk management tools, methods, processes, and policies and the simplified ICT risk management framework

ICT-related incidents: management, classification and reporting

The DORA Regulation requires financial entities to establish a process to detect and manage ICT-related incidents; this process includes the following measures:

  • warning indicators;
  • procedures to identify, track, log, categorise and classify ICT-related incidents according to their priority and severity and according to the criticality of the services impacted. Article 18 lists the factors that need to be taken into consideration for the classification of the incidents.
  • a communication plan on the incident for clients, staff, external stakeholders and media;
  • response procedures to mitigate impacts and ensure that services become operational and secure in a timely manner.

Lastly: when handling an ICT-related incident financial entities needs to ensure that at least major ICT-related incidents are reported to the management body, explaining the impact, response and additional controls to be established as a result of such ICT-related incidents.

Reporting of major ICT-related incidents

In case of major ICT-related incident, according to article 19, financial entities have a duty to inform:

  • clients, if the incident had an impact on their financial interests;
  • competent authorities, in 3 steps:
    1. an initial notification;
    2. an intermediate report on how the situation evolves after the initial notification;
    3. a final report on what caused the incident, when all the relevant information are available.

When does an ICT-related incident is deemed major ?

‘major ICT-related incident’ means an ICT-related incident that has a high adverse impact on the network and information systems that support critical or important functions of the financial entity;

Article 3 (10)

Update

The Commission Delegated Regulation EU n° 2024/1772 regulatory technical standards specifying the criteria for the classification of ICT-related incidents and cyber threats.

Voluntary notification of cyber threats

Financial entities may, on a voluntary basis, notify significant cyber threats to the relevant competent authority when they deem the threat to be of relevance to the financial system, service users or clients.

Article 19(2)

In order to achieve harmonisation of reporting content, the European Supervisory Authorities (ESAs) will submit by 17 July 2024 a draft on regulatory technical standards on the content of the reports for major ICT-related incidents. The goal is to enable the development of standards and templates for these reports.

Digital operational resilience testing

The DORA Regulation requires that financial entities other than microentreprises undergo a digital operational resilience testing programme on a regular basis. These tests are meant to assess the readiness of the financial entity to handle possible ICT-related incidents, identify weakness and implement corrective measures when needed.

  • tests are undertaken by independent parties, whether internal or external.
  • ICT systems and applications supporting critical or important functions need to be tested at least once a year.

As to the kind of tests to include in the programme, Article 25 mentions:

  • vulnerability assessments and scans;
  • open source analyses;
  • network security assessments;
  • gap analyses,
  • physical security reviews;
  • questionnaires and scanning software solutions;
  • source code reviews where feasible;
  • scenario-based tests;
  • compatibility testing;
  • performance testing;
  • end-to-end testing and penetration testing.

Threat led penetration testing: TLPT

Financial entities other than microenterprises are due to carry out at least every 3 years advanced testing by means of TLPT, which shall cover several or all critical or important functions of a financial entity, and shall be performed on live production systems supporting such functions.

What is a threat led penetration test?

‘threat-led penetration testing (TLPT)’ means a framework that mimics the tactics, techniques and procedures of real-life threat actors perceived as posing a genuine cyber threat,

What financial entity are required to carry out TLPT?

The competent authorities identify the financial entities that are required to carry out TLPT: the selection is based on how significant the financial entity and the services it provides are for the financial sector. For instance, what impact an ICT incident involving certain financial services would have on the financial sector: possible financial stability concerns, including the systemic character of the financial entity at Union or national level.

The ESAs will submit draft regulatory technical standards on TLPT by 17 July 2024.

Managing of ICT third-party risk

The fifth chapter of the DORA regulation concerns the risk stemming from external providers of ICT services; financial entities relying on ICT third-parties need to:

  • adopt a strategy on ICT third-party risk, particularly for those ICT services supporting critical or important functions;
  • keep a register of information on all the contractual arrangements concluded with ICT third-party service providers.
  • inform competent authorities on any planned contractual arrangement on the use of ICT services supporting critical or important functions.
  • terminate the contract with the third party in the following cases:
    1. the ICT third party service provider breaches applicable laws, regulations or contractual terms;
    2. changes in the circumstances that alter the performance of the functions provided through the contractual arrangement, including material changes that affect the arrangement or the situation of the ICT third-party service provider;
    3. the ICT third party is found unable to handle its overall ICT risk management and in particular in the way it ensures the availability, authenticity, integrity and, confidentiality, of data
  • put in place exit strategies for the ICT services supporting critical or important functions. The financial entity may resort to exit contractual agreements when the third party is no longer reliable: in these cases the exit strategy should ensure that the contract is terminated without disrupting the financial services or breaching any regulatory requirement.

Lastly: The DORA regulation requires that contracts between financial entities and ICT third-party service providers include certain elements: the key contractual provisions listed by article 30.

Update

The Commission Delegated Regulation EU n° 2024/1773 regulatory technical standards specifying the detailed content of the policy regarding contractual arrangements on the use of ICT services supporting critical or important functions.

ICT concentration risk

When choosing external providers of ICT services to support critical or important functions, financial entities need to take into account the concentration risk, that is when:

  1. contracting an ICT third-party service provider that is not easily substitutable; or
  2. having in place multiple contractual arrangements in relation to the provision of ICT services supporting critical or important functions with the same ICT third-party service provider.

In addition to that, financial entities have to consider:

  • whether the contract with the provider allows the subcontract of ICT-services supporting critical or important functions;
  • the impact of the bankruptcy of the ICT provider in the light of the applicable insolvency law provisions.
  • if the ICT provider is based on a third country, the compliance with Union data protection rules and the effective enforcement of the law in that third country.

Oversight Framework of critical ICT service providers

The DORA regulation establishes an oversight framework dedicated to ICT service providers deemed as critical, which enables an enhanced scrutiny on financial entities meeting certain requirements.

Designation of critical ICT service providers

The oversight framework applies to ICT service providers designated as critical; the designation is up to the ESAs and is based on the following criteria (article 31):

  • the impact that a disruption of the provider's ICT services would have on the financial services that rely on them;
  • the systemic character or importance of the financial entities that rely on the relevant ICT third-party service provider,
  • the ICT services support critical or important functions of financial entities;
  • the degree of substitutability of the ICT third-party service provider: whether there are alternative providers or the migration to other providers is hampered by significant financial costs, time or other resources that the migration process may entail.

The Commission will adopt, by 17 July 2024, a delegated act which will further specify the criteria and requirements for the designation of critical ICT-service providers. Until then, no critical service providers will be designated.

If the critical ICT service provider is based in an non-EU country, the DORA regulation requires that the provider establishes a subsidiary in the Union within the 12 months following the designation.

The Lead Overseer

Once designated as critical, the ICT service provider is assigned to the supervision of a Lead Overseer, chosen among one of the 3 ESAs. It is appointed as Lead Overseer of the provider the ESA in charge of the supervision on the financial entities representing together the largest share of the provider's clients. For instance, if the ICT service provider supplies its services mostly to financial entities in the banking sector, the EBA will be appointed as lead overseer of that ICT service provider.

Tasks of the Lead Overseer

The Lead Overseer is responsible for assessing whether the critical ICT-service provider has in place comprehensive, sound and effective rules, procedures, mechanisms and arrangements to manage the ICT risk which it may pose to financial entities. The supervision of the Lead Overseer is mostly focused on the ICT services supporting the critical or important functions of the financial entities.

In short, ICT service providers are designated as critical, and put under the close scrutiny of one of the 3 ESAs, when the services they provide are crucial for the financial entities that rely on them, and any disruption of their ICT services is likely to disrupt some key financial services as well.

For each critical ICT service provider the Lead Overseer adopts a detailed oversight plan describing the annual oversight objectives and the main oversight actions planned for each critical ICT third-party service provider

Among the powers of the Lead Overseer, detailed in article 35, there is the power to impose penalty payments to compel critical ICT third-party service providers to comply with the transparency and access-related obligations set out in the Regulation (recital n° 81). The amount of the penalty can be up to 1 % of the average daily worldwide turnover of the critical ICT third-party service provider in the preceding business year.

Those powers should enable the Lead Overseer to acquire real insight into the type, dimension and impact of the ICT third-party risk posed to financial entities and ultimately to the Union’s financial system

Recital n° 88

Conclusions

In conclusion, a quick recap.

  • DORA is the EU regulation on digital operational resilience for the financial sector; it sets out requirements and obligations for financial entities on ICT risk and ICT incidents management.
  • The compliance effort for financial entities changes depending on:
    • the size of the financial entities: the smaller ones are subject to lighter requirements, as we have seen for the simplified ICT risk management framework;
    • the risk that the use of a ICT service entails for the financial entity and the financial sector itself: requirements are stricter for services supporting critical or important functions of the financial entity.
  • Financial entities are required to carry out digital operational resilience tests on a regular basis; ESAs identify the financial entities that are required to perform advanced tests such as threat led penetration tests every 3 years.
  • The Regulation provides specific requirements for contractual arrangements between financial entities and ICT third-party service providers, particularly for ICT services supporting critical or important functions.
  • Lastly: the DORA Regulation establishes an Oversight Framework for critical ICT service providers: every provider designated as critical by the ESAs is subject to a dedicated and closer scrutiny.


About the author

Vincenzo Lalli

Vincenzo Lalli

Founder of Avvocloud.net

Avvocloud is an Italian network of lawyers passionate about law, innovation and technology.
Feel free to reach out for any info: send a message.

Thanks for reading!

Creative Commons License