Are you a board member, a C-Suite executive, the CIO, an ICT manager or a third-party ICT vendor? What DORA is to you depends on your role.
The Digital Operational Resilience Act (DORA) is an EU regulation aimed at enhancing the digital operational resilience of financial entities. It mandates that these institutions can withstand, respond to, and recover from ICT-related disruptions and threats. DORA will be applicable from January 17, 2025, and builds upon existing frameworks like those from the European Banking Authority (EBA) and national regulations.
So far, so good, but what is DORA to various stakeholders? In this article we set out to answer what DORA is for people in five different roles: Board members, C-Suite executives, CIOs, ICT managers and third-party fintech vendors. For each role, we give a brief description of the DORA responsibilities, as well as a set of questions that should be answered to make sure you do your part.
Our research includes feedback from the team developing our digital solution for third-party ICT service provider risk, and white papers from leading industry experts. Based on these, we believe there are eight larger common denominators when it comes to DORA compliance challenges:
Board members hold ultimate responsibility for the entity's ICT risk management and operational resilience strategy. The board room is the place for strategic oversight. Thus, board members must define, approve, and oversee the implementation of the ICT risk management framework, ensuring it aligns with the organization's overall risk appetite and business objectives.
To approach the challenge at hand, most board members need to enhance or update their ICT knowledge. Board members should acquire sufficient knowledge to understand and assess ICT risks and their potential impact on the organization. Then comes the regular reviews: Board members should conduct periodic assessments of ICT-related risks and the effectiveness of implemented controls.
Having the ultimate responsibility, board members should ask the C-Suite executive (and CIO) questions regarding the full scope of DORA:
Policy implementation is the responsibility of C-Suite executives. The CEO and his or her team must ensure that policies and procedures are in place to manage ICT risks effectively. To this end, they must allocate appropriate financial and non-financial resources to support ICT risk management and resilience initiatives.
To ensure implementation, the approach should be built on cross-functional collaboration. C-Suite executives should work closely with ICT managers, compliance officers, and other stakeholders to integrate ICT risk management into the organization's operations. And to follow up, it is useful to establish key performance indicators (KPIs) to monitor the effectiveness of ICT risk management strategies.
C-Suite executives should ask the CIO (or ICT managers) questions to confirm sound implementation, such as:
Depending on the size of the financial institution, we are now getting close to where the actual DORA compliance work is done. It is the CIO’s responsibility to develop and maintain a robust ICT risk management framework. This framework must include risk identification, assessment, mitigation, and monitoring processes.
Incident management is key. Thus, the CIO should implement processes to detect, manage, and notify ICT-related incidents, ensuring compliance with DORA's reporting requirements. Since threats are always moving targets, it is important to regularly update ICT policies and procedures to address emerging threats and technological advancements. This work will be strengthened by ensuring that staff receive ongoing training on ICT security awareness and digital operational resilience.
To ensure the effective implementation of the ICT risk management framework, the CIO should collaborate closely with ICT managers who are more hands-on in day-to-day DORA compliance:
A hands-on CIO may find it useful to read our checklist for DORA compliance.
ICT managers are responsible for daily operations that relate to DORA requirements. This includes overseeing the day-to-day management of ICT systems, ensuring their availability, integrity, and security. ICT managers are responsible for monitoring compliance with ICT policies and procedures, addressing any deviations promptly (incident management).
A key part of an ICT manager’s approach to DORA compliance is to maintain an up-to-date inventory of all information and ICT assets, including those provided by third-party service providers. Also, ICT managers need to conduct regular testing of business continuity and disaster recovery plans to ensure preparedness for potential disruptions.
Our checklist for DORA compliance is tailored to the everyday need of ICT managers.
Here is a list of activities that will help ICT managers help their financial institutions complying with DORA – reducing ICT risk and improving resilience:
Now, we are moving outside the financial institution – to its third-party fintech providers. Contractual compliance is at the center of what DORA is for an ICT vendor delivering fintech to a financial institution. Especially, third-party providers must adhere to contractual obligations related to ICT risk management and operational resilience as stipulated by financial entities.
Transparency is key for a third-party vendor. This includes providing necessary information to financial entities to facilitate their compliance with DORA requirements. Also, engage proactively with clients to address ICT risk management concerns and participate in resilience testing exercises. To these ends, it is important to understand DORA's implications and align services and contractual terms to support clients' compliance efforts.