As we marked the full implementation of the Digital Operations Resiliency Act (DORA) on January 17, 2025, it is crucial for senior IT leaders in financial services organisations, such as wealth managers, asset managers, and private equity firms, to understand the full implications and prepare accordingly. Recently, I had the opportunity to lead a panel discussion with industry experts to delve into the intricacies of DORA and provide actionable recommendations.

Understanding DORA

DORA was introduced to harmonise cyber security regulations across Europe, specifically for financial services. The act mandates stringent requirements around Information Communication Technology (ICT) risk management, incident notification, and digital operational resilience testing. The goal is to ensure that financial institutions can withstand, respond to, and recover from all types of ICT-related disruptions and threats.

The full recording of the webinar session can be found here (45 minutes) and includes panel experts: Rosalyn Breedy, Breedy Henderson; Simon Eyre, Drawbridge; and Geoff Bird, Mount Street Group who gave their perspectives as a lawyer, vendor and financial services firm as well as Lanware’s Henry Duncombe and Dan O’Hara to give a managed service provider viewpoint.

Five recommendations from the panel:

1. ICT risk management and governance: Ros Breedy emphasised the importance of board-level understanding and individual responsibilities. It is essential for boards to be fully aware of their roles in overseeing ICT risk management and governance to ensure compliance with DORA. This involves regular training and updates to keep board members informed about the latest developments and threats in the ICT landscape.
2. ICT third-party risk management: Dan O’Hara highlighted the need for robust third-party risk management practices. This includes assessing the impact of third-party services on operational resilience and business continuity planning. DORA places a special focus on separating critical and non-critical ICT third-party service providers and imposes different levels of oversight and contractual obligations on them. Regular audits and assessments of third-party providers are crucial to ensure they meet the required standards.
3. Incident reporting: Simon Eyre discussed the requirements for incident reporting under DORA. Unlike some other cyber incident reporting, DORA mandates specific notification time frames and detailed reporting to regulators. This ensures that all incidents are promptly addressed and mitigated. It is vital that firms establish clear protocols for incident detection, reporting, and response to comply with these requirements.
4. Digital operational resilience: Geoff Bird provided insights into the central focus of DORA, which is digital operational resilience. He advised that firms should prioritise building robust systems and processes that can withstand and recover from disruptions. This includes regular testing and updating of resilience measures. Firms should also conduct scenario-based testing to identify potential weaknesses and improve their response strategies.
5. Information sharing: Henry Duncombe underscored the importance of information sharing among financial institutions. DORA requires firms to share relevant information about threats and vulnerabilities to enhance collective resilience. This collaborative approach is vital for staying ahead of emerging threats. Establishing trusted networks and platforms for information sharing can significantly improve the overall security posture of the financial services sector.

Where are you on your DORA journey?

During the discussion, we also explored where different organisations are in their DORA journey. Geoff shared his firm's progress, highlighting the steps they have taken and the challenges they have faced. It was evident that while some firms are well on their way to compliance, others are still grappling with the complexities of the act. It is important for all firms to assess their current state and identify areas that need improvement to ensure full compliance.

Ask yourself five key DORA questions

Now we have passed the DORA implementation date, I encourage you to reflect on the following questions:

• How well does your board understand its responsibilities under DORA?
• Have you assessed the impact of your third-party service providers on your operational resilience?
• Are your incident reporting processes aligned with DORA's requirements?
• What measures have you put in place to ensure digital operational resilience?
• How are you contributing to information sharing within the financial services community?

By addressing these questions, you can better prepare your organisation for the challenges and opportunities that DORA presents.