PECB DORA Foundation cheat sheet

DORA (Regulation (EU) 2022/2554) applies to a closed list of financial entities: credit institutions, payment institutions, e-money institutions, investment firms, crypto-asset service providers, central securities depositories, central counterparties, trading venues, trade repositories, UCITS and AIF managers, insurance and reinsurance undertakings and intermediaries, occupational pension institutions, credit rating agencies, crowdfunding service providers, and securitisation repositories.

Digital operational resilience is the ability of a financial entity to build, assure and review its operational integrity and reliability by ensuring, directly or through third parties, the full range of ICT-related capabilities needed to address security of networks and information systems, protect against cyber threats, detect and prevent ICT disruptions, respond to and recover from incidents, and manage third-party ICT risk.

The five DORA pillars are: (1) ICT risk management, (2) ICT-related incident management, classification and reporting, (3) digital operational resilience testing, (4) ICT third-party risk management, and (5) information-sharing arrangements on cyber threat information and intelligence.

DORA is a regulation, not a directive: it applies directly in all EU Member States without national transposition, and it prevails over conflicting sectoral rules on ICT risk and incident reporting.

Proportionality rule: the ICT risk management framework must be proportionate to the size, business and risk profile, and complexity of the entity's services and operations; simplified frameworks apply to certain small and non-interconnected entities.

The ICT risk management framework is a documented, sound and comprehensive set of policies, procedures, protocols and tools that covers the whole ICT lifecycle and is reviewed at least once a year (and after major changes or incidents).

ICT risk is defined as any reasonably identifiable circumstance relating to the use of network and information systems that, if it materialises, may compromise the security of those systems or the data, processes or operations they support.

Responsibility sits with the management body, which defines and approves the digital operational resilience strategy and bears ultimate accountability; DORA does not permit this accountability to be outsourced or delegated away.

A critical ICT third-party service provider is an ICT third-party provider designated by the ESAs on the basis of criteria including systemic impact, reliance by financial entities on its services, and substitutability, and is subject to an EU-level oversight framework.

The framework must include at least: ICT risk management strategy, policies, procedures and tools; governance and organisation; an ICT asset and dependency inventory; business continuity, backup and recovery; incident detection and response; and testing and review arrangements.

The management body must define, approve, oversee and be accountable for the digital operational resilience strategy, including risk tolerance level, and must ensure adequate budget and staffing for ICT risk management.

The management body must devote sufficient time to ICT risk matters, and at least one member (or a dedicated committee) must have appropriate ICT and security expertise; training is required on a regular basis.

An internal control framework with three lines of defence is required: an ICT risk management function, an independent compliance/risk oversight function, and an independent audit function (internal or external).

The ICT asset inventory must record all ICT assets, dependencies and third-party arrangements, be kept up to date, and be granular enough to support risk assessment, incident response and recovery prioritisation.

Business impact analysis and risk assessment must identify critical or important functions and their ICT dependencies, and must be reviewed at least annually and after significant change; recovery objectives (RTO/RPO) must be set for critical functions.

Business continuity policy must include backup policies and methods, restoration and recovery procedures, and crisis communication plans; backups must be kept separate and secure and restoration must be tested, not merely documented.

Entities must implement ICT security policies covering access control, authentication, encryption, patch and vulnerability management, network security, logging and monitoring, and secure change management, and must maintain segregation of duties.

ICT-related incidents must be logged, managed, classified and reported to the competent authority under the major-incident thresholds (impact, duration, geographic spread, data loss, criticality of services, economic impact); incident response plans must be tested and reviewed.