DORA: Six Key Action Points for Firms

DORA entered into force on 16 January 2023, creating a European regulatory framework to strengthen the financial sector’s resilience to information and communication technology (“ICT”) disruptions and threats².

To determine where potential compliance gaps may lie, Firms should undertake a gap analysis on their current ICT frameworks, including their existing ICT systems, policies and procedures, to determine what elements need to be updated to comply with DORA.

2. Develop an ICT Risk Management Framework

DORA will require Firms to update their governance policies to ensure effective and prudent management of ICT risk and to
develop and implement a sound, comprehensive and well-documented ICT risk management framework as part of their broader risk management system. As part of this process, Firms will need to carry out assessments of their ICT supported business functions, roles and responsibilities; the information assets and ICT assets supporting those functions; their roles and dependencies in relation to ICT risk; and, on an ongoing basis, identify all sources of ICT risk.

Appropriate policies and processes will also need to be developed on monitoring and controlling the security and functioning of ICT systems, the detection of anomalous activities, and ICT business continuity. Firms should also ensure that they have capability to gather information on vulnerabilities and cyber threats, ICT-related incidents and analyse the impact they are likely to have on their digital operational resilience.

3. Manage ICT Risk Incident

To meet their ICT risk management obligations under DORA, Firms will need to establish and implement ICT-related incident management processes to detect, manage and notify ICT-related incidents. Firms will also be expected to record all ICT incidents and significant cyber threats.

“Major” ICT-related incidents must be reported to the Central Bank within prescribed timeframes. The initial report must be made within four hours from the moment of classification of the incident as major, but no later than 24 hours from the time of detection of the incident. A subsequent intermediate report must be made within 72 hours from the classification of the incident as major, or when regular activities have been recovered and business is back to normal. The final report must be submitted no later than one month from the classification of the incident as major.

In order to ensure that notifications can be made within the prescribed timeframes, we recommend Firms put in place policies and procedures specifically addressing the detection, management, recording and assessment of ICT-related incidents and the Firm’s processes for reporting major incidents.

4. Implement ICT Testing Programmes

Firms should implement or assess the adequacy of their existing digital operational resilience testing programmes for ICT tools and systems and make any necessary updates to comply with DORA. Firms should also ensure that testing on all ICT systems and applications which support critical or important functions is carried out at least annually.

Firms should also determine whether they are subject to the obligation to carry out Threat-Led Penetration Testing (“TLPT”) every three years. The requirement to conduct TLPT is based on various impact-related and systemic character related factors as well as ICT risk related factors regarding the Firm.

If a Firm is required to carry out TLPT, it should put in place the necessary arrangements to carry out such testing. Firms may use either internal or external testers for carrying out TLPT, however if a firm uses internal testers, it must contract external testers to conduct TLPT every three tests.

5. Third-Party ICT Services

DORA expects Firms to manage third-party ICT risk as a key principle within their ICT risk management frameworks. This includes adopting and regularly reviewing a strategy on ICT third-party risk, and a policy on the use of ICT services supporting critical or important functions provided by ICT third-party service providers. Firms will also need to maintain, at entity level and at sub-consolidated and consolidated levels, a register of information on all contractual arrangements on the use of ICT services provided by ICT third-party service providers. The required form of this register will be set out in level 2 regulations due to be published in July 2024. However, given the volume of information required to be inputted to the register we recommend Firms begin collating this information well in advance of DORA’s application.

Firms will also need to assess and, if necessary, update their existing contractual arrangements with third-party ICT service providers to ensure that they include the specific elements required by DORA, such as:

• complete descriptions of all functions and ICT services to be provided, including details of any subcontracting;
• details of the regions or countries, where the contracted or subcontracted functions and ICT services are to be provided and where data is to be processed;
• provisions on the availability, authenticity, integrity, confidentiality, access, recovery and return of data;
• service level descriptions; and
• various assistance obligations.

^{2 For an overview of the DORA framework, see our previous Client Update: https://maples.com/en/knowledge-centre/2023/1/dora-new-eu-operational-resilience-regime-for-the-financial-sector}