Cyber Security: The Dawn of DORA

As we approach 2025, the financial sector in Europe faces a significant milestone. The Digital Operational Resilience Act (DORA), introduced in January 2023, has set a two-year compliance deadline for European financial institutions. This landmark regulation represents a substantial shift in the digital operational resilience landscape, aiming to standardise and strengthen the sector’s defences against the rising tide of cyber threats.

DORA’s core objective is to harmonise the approach to managing Information and Communication Technology (ICT) risks across the financial industry. This includes establishing comprehensive risk management frameworks and classifying ICT-related incidents, ensuring a consistent and effective response to digital threats. The regulation is a response to the growing concern over cybercrime and fraud, highlighted by the significant financial losses incurred through such activities in recent years.

In a pivotal development, the European Supervisory Authorities (ESAs), comprising the EBA, EIOPA, and ESMA, have released the first set of technical draft standards under DORA. These standards focus on ICT risk management frameworks, criteria for classifying ICT-related incidents, and policies on ICT third-party service providers. This release marks a crucial step in operationalising DORA’s objectives, providing a concrete foundation for financial entities to enhance their digital resilience strategies.

Financial institutions face daunting challenges in adapting to DORA. Legacy systems, siloed data, and the complexity of integrating new technologies pose significant hurdles. A staggering number of banks still lack a reliable, up-to-date IT asset inventory, leading to increased vulnerability to cyberattacks. The push for DORA compliance underscores the urgent need for these institutions to enhance their operational visibility and resilience.

The financial industry, while supportive of DORA in principle, has expressed concerns about the implementation challenges. Industry bodies like the Association for Financial Markets in Europe (AFME) highlight the need for a proportionate and phased approach to enforcement, particularly concerning supplier contracts and the establishment of new information registers.

DORA’s 2025 deadline is not just a regulatory checkpoint; it’s an opportunity for the financial sector to redefine its approach to cyber security and operational resilience. As the landscape evolves, institutions that proactively adapt to these changes will emerge stronger, more agile, and better equipped to face the digital challenges of tomorrow.