The Digital Operational Resilience Act (Regulation (EU) 2022/2554) solves an important problem in the EU financial regulation, as it “aims to consolidate and upgrade ICT risk requirements as part of the operational risk requirements that have, up to this point, been addressed separately in various Union legal acts. While those acts covered the main categories of financial risk (e.g. credit risk, market risk, counterparty credit risk and liquidity risk, market conduct risk), they did not comprehensively tackle, at the time of their adoption, all components of operational resilience.”
What are the key components of DORA?
Essentially, DORA is divided into five key pillars, as summarised below:
1. ICT Risk Management
DORA establishes a set of requirements on the ICT risk management framework to be imposed on the in-scope entities, including amongst others:
- having in place an internal governance and control framework that guarantees effective ICT risk management;
- implementing a comprehensive ICT risk management framework, subject to yearly review and internal audit;
- ensuring that their ICT is up to date, reliable, properly designed, and technically stable; and
- implementing disaster and recovery policies to ensure a prompt recovery after and ICT-related incident.
2. ICT-Related Incident Reporting
DORA also requires in-scope entities to:
- implement procedures to ensure consistent monitoring, management and following-up of ICT-related incidents so as to prevent incidents from occurring;
- classify the incident in relation to the criteria specified in the Regulation and developed further by the European Supervisory Authorities (ESAs), such as the European Banking Authority (EBA), the European Securities and Markets Authority (ESMA) and the European Insurance and Occupational Pensions Authority (EIOPA);
- document ICT-related incidents, and report any incidents deemed as ‘major’ to the relevant authority – reporting deadlines are to be determined by the ESAs; and
- submit reports on ICT-related incidents to their users and clients.
3. Resilience Testing
In-scope entities will have to test their digital operational resilience at least every year, taking into account their size, business and risk profiles. Throughout the performance of the tests, entities must establish procedures to be able to classify and remedy all revealed issues. Any identified weaknesses, gaps or deficiencies must be quickly eliminated or mitigated with the application of counteractive measures.
The ESAs will elaborate on testing methodologies. In the interim, entities can use the European Central Bank’s (ECB) Threat Intelligence-Based Ethical Red-Teaming framework as a guide. Entities identified as being of particular systemic standing (in accordance with a framework to be developed by the ESAs) will have to conduct Threat Led Penetration Testing (TLTP), also known as a Red/Purple Team Assessment, to address higher levels of risk exposure.
4. ICT Third-Party Risk Management
ICT third-party risk needs to be managed by entities as an integral part of their ICT risk management framework. ‘Critical’ ICT third-party service providers, which are to be designated by the ESAs, are also subject to a Union Oversight Framework, whereby each critical ICT service provider will be designated a Lead Overseer (either EBA, ESMA or EIOPA).
DORA requires in-scope entities to, amongst others:
- have in place contractual arrangements for the use of ICT services and make specific risk-management related assessments before entering into new contractual arrangements;
- maintain an updated information register on all contractual arrangements for the use of ICT services provided by third-party service providers;
- report at least every year to the respective competent authorities on the number and type of contractual arrangements and the categories of ICT third-party service providers; and
- inform the respective competent authorities about any intended contractual arrangement for the use of ICT services supporting critical or important functions.
5. Information Sharing Between Financial Entities
Financial entities are encouraged to exchange amongst themselves cyber threat information and intelligence, in accordance with applicable legislation, in order to enhance their digital operational resilience; raise awareness on ICT risks and minimise the spreading of ICT threats; and support each other’s defensive techniques, mitigation, response and recovery stages.
Who are the in-scope entities?
There are a wide range of entities that fall within the scope of DORA, as summarised below:
Financial Entities
- Credit institutions
- Payment institutions
- Account information service providers
- Electronic money institutions
- Investment firms
- Cryptoasset service providers
- Central securities depositories
- Central counterparties
- Trading venues
- Trade repositories
- AIFMs
- Management companies
- Data reporting service providers
- Insurance and reinsurance undertakings
- Insurance intermediaries, reinsurance intermediaries and ancillary insurance intermediaries
- Institutions for occupational retirement provision
- Credit rating agencies
- Administrators of critical benchmarks
- Crowdfunding service providers
- Securitization repositories
ICT Third-Party Service Providers
- An undertaking providing ICT services, i.e. digital and data services provided through the ICT systems through one or more internal or external users on an ongoing basis, including hardware as a service and hardware services which include technical support via software or firmware updates by the hardware provider, excluding traditional analogue telephone services
- Critical ICT third-party service provider
Adoption, Applicability and Enforcement
DORA entered into force on 16 January 2023 and shall apply as from 17 January 2025 in its entirety and directly applicable in all Member States. The ESAs have already started preparing for its implementation, whereas in-scope entities will only have a limited time to implement it which, in view of DORA’s technical and operational complexity, is expected to be a challenge.
The Malta Financial Services Authority (MFSA), will take the role of compliance oversight and enforce the regulation as required. As to enforcement, DORA does not provide for fines or other sanctions for non-compliance and Member States are required to stipulate appropriate sanctions and remedies for breaches of the Regulation to ensure that they are effectively implemented in their national law, which remains to be seen.
About the Authors
This article has been co-authored by INPLP member Gege Gatt, Dr Franklin Cachia, CSB Group Director – Tax & Regulated Industries and Dr Luana Agius, Junior Regulated Industries Advisor. Contact us on csbgroup.com/contact-us/ for more information.
This article was originally published by the International Network of Privacy Law Professionals (INPLP) on 4th of April 2023.