Understanding the DORA standard: a guide for companies

What is the DORA standard?

DORA is a European regulation that sets out clear requirements to ensure that companies in the financial sector are sufficiently prepared to deal with digital risks, cyber attacks and service disruptions. The aim is to make the EU's financial sector more resilient to digital threats and protect users' data and transactions.

The standard is structured around several main areas:

• Risk management: Companies must identify, assess and manage technological risks.
• Resilience testing: They are required to carry out regular tests to ensure their ability to withstand cyber attacks and other operational incidents.
• Incident reporting: The standard imposes a framework for reporting significant incidents for a rapid and effective response.
• Monitoring of third-party providers: DORA requires increased monitoring of critical service providers to avoid any breaches originating from outside the company.

To whom does DORA apply?

DORA primarily targets companies in the financial sector, including, but not limited to:

• Banks
• Insurance companies
• Fund managers
• Payment platforms
• Investment services firms
• Crypto-asset companies

The standard also applies to third-party providers of ICT (Information and Communication Technology) services, such as cloud companies, cybersecurity solution providers and other essential providers. Thus, technology companies collaborating with financial institutions must also comply with DORA requirements to guarantee the continuity and security of their services.
This text covers 21 categories of financial sector entities,which would represent more than 22,000 entities within the EU (according to the European Parliament's draft legislative resolution)

How to prepare for DORA as a company?

DORA compliance requires careful preparation and several key steps to meet the requirements. Here's a practical guide for companies wishing to prepare effectively:

1. Assess digital and operational risks
   Companies need to identify digital risks in their current infrastructure. This includes mapping critical systems, assessing potential vulnerabilities and analyzing the possible impacts of cyber incidents.
2. Implement risk management policies
   Developing and strengthening technology risk management policies is essential. This includes defining incident response procedures, deploying security and data protection measures, and establishing a framework for business continuity.
3. Perform regular resilience testing
   DORA requires companies to regularly test their digital resilience. This can include penetration testing, attack simulations (such as red teaming) and business continuity assessments to validate the effectiveness of systems in the face of cyber threats.
4. Strengthen incident reporting procedures
   Implementing a prompt and accurate incident reporting process is crucial. DORA requires significant incidents to be reported to the relevant supervisory authorities. Make sure you have a system in place to quickly document and notify incidents to minimize their impact.
5. Monitoring and managing third-party suppliers
   For companies working with external service providers, DORA imposes heightened vigilance. It's essential to assess the security of partners, check the compliance of their practices and establish contractual clauses on their resilience to digital risks.
6. Awareness raising and team training
   Cybersecurity culture is key to meeting DORA requirements. Training employees in security practices, incident management protocols and reporting procedures can reduce the risk of human error and strengthen overall resilience.

Why is DORA compliance crucial?

By complying with DORA, companies not only benefit from improved security in the face of cyber threats, they also boost the confidence of their customers and partners. The standard enables companies to prevent major disruptions, respond more effectively to incidents and maintain quality of service even in a crisis. It is part of a proactive approach to creating a safer, more reliable European financial ecosystem.

What sanctions should be applied in the event of non-compliance?

The assessment and imposition of penalties for breaches of legal obligations are left to the discretion of member states and competent authorities. The latter have the option of putting in place various measures, including financial penalties, to ensure that financial entities comply with their legal obligations (article 50.4 c).

As regards critical ICT (Information and Communication Technology) service providers, the competent authority may carry out checks, whether documentary or on-site. In the event of non-compliance, sanctions may be applied, such as financial penalties and daily penalty payments of up to 1% of the provider's worldwide sales. These sanctions may be maintained for a maximum period of 6 months (article 35).

Conclusion

The DORA standard marks a turning point in the protection of financial companies from digital threats. By implementing a rigorous preparation strategy and complying with the standard's requirements, companies in the financial sector can strengthen their operational resilience and contribute to the security of the entire European financial system.

Preparing for DORA may seem complex, but by following these steps and instilling a culture of cybersecurity, companies can turn this obligation into a strategic asset.

Cyber Connect is setting up a DORA support for its customers, to help you put the building blocks of your compliance in place step by step.