Achieve DORA Compliance with VMGroup

The DORA draft, published in September 2020, forms part of the European Commission Digital Finance Strategy. When the Act is implemented, it will be passed into law by each EU state. Further technical standards will be developed by the European Supervisory Authorities and compliance will be overseen by the existing National Competent Authority framework.

DORA is aimed to strengthen the resilience, reliability, and continuity of financial services throughout the European Union (EU). DORA became active in Ireland on January 16th, 2023, following publication in the Official Journal of the European Union on December 27, 2022. A two-year implementation period applies until January 17th, 2025, after which organisations in scope are expected to be compliant. Financial institutions are required to design, procure, and implement appropriate security strategies and policies to detect and prevent ICT risks and anomalous activities.

Why is DORA being introduced?

• To address the shift in risk profile, owing to the increased financial services digital adoption.

• To mitigate risk posed by growing vulnerabilities, due to the increasing interconnectivity of the financial sector.

• To acknowledge and address the third-party reliance underpinning the stability of the financial sector.

• To adopt a single, consistent supervisory approach to operational resilience across the single market.

Five Core Pillars of DORA:

1. ICT Risk Management: Financial institutions must identify, assess, mitigate, and monitor ICT risks across their entire operations.

2. Incident Reporting: Mandatory reporting of major ICT incidents to regulators, with clear timelines and procedures.

3. Penetration Testing and Vulnerability Assessments: Regular testing of systems and infrastructure to identify vulnerabilities.

4. Information Sharing and Cooperation: Encouraging financial institutions to share information about ICT threats and incidents with each other and regulators.

5. Outsourcing: Establishing stringent requirements for outsourcing ICT functions to third-party vendors.

Our Methodology:

Based on our information security expertise, in-depth knowledge of industry practices, awareness of regulatory requirements, and experience in performing audits for many organisations, we have formulated a methodical process that ensures clarity, consistency, and continuous improvement.

VMGroup will conduct a current state gap assessment of your environment based on the Digital Operations Resiliency Act (DORA) Regulation (EU) using the following phased approach:

1 Process Understanding

• Gain an understanding of the current procedures and associated processes with respect to DORA

• Acquire relevant documentation for review

• Acquire additional evidence based on process and documentation understanding

2 Gap Analysis

• Map relevant controls and processes of DORA to your environment

• Analyse the current state in accordance understanding gained from the previous phase

• Identify gaps and associated risks related to DORA Acts

3 Gap/ Compliance Reporting

• Recommend appropriate remediation for identified gaps and risks identified in previous phase

• Draft Gap Analysis / Compliance Report

• Discuss identified gaps with relevant stakeholders

Takeaways

DORA places a premium on operational resilience, cybersecurity, and incident reporting. In an era where digital threats are evolving at an unprecedented pace, compliance with DORA is not just a legal requirement but a strategic imperative. Financial entities need to proactively enhance their cybersecurity measures to ensure they can withstand and recover from any cyber incident. Individuals who align themselves with the requirements of the mandatory framework will benefit immensely. Our expert team is adapt at navigating complex regulatory landscapes, offering bespoke services that work best for your needs, ensuring a seamless and effective transition to a more secure environment.

We would love to hear your thoughts on the looming regulation and how are you preparing for it today?

Contact a member of our team today to discuss your requirements