DORA: digital resilience, a governance issue

The framework at a glance

DORA is EU Regulation 2022/2554. Like any European regulation, it applies directly, without national transposition, and uniformly throughout the Union. In Luxembourg, the Commission de Surveillance du Secteur Financier (CSSF) ensures its monitoring. It concerns a wide range of entities — banks, investment firms, fund managers, insurers, crypto-asset service providers — as well as their IT service providers. A proportionality principle eases the obligations for smaller structures.

The regulations are organised around five pillars:

• IT risk management ;
• the detection and notification of major incidents; ;
• resilience tests, extending to advanced penetration testing for the most significant entities; ;
• management of IT vendor risk ;
• threat intelligence sharing.

DORA complements the broader NIS2 Directive by providing the financial sector with a specific and more demanding framework.

What DORA changes in practice

• Responsibility at the top. The IT risk management framework is the responsibility of the management body, which must approve it, understand it and oversee its implementation.
• A register of IT service providers. Each entity shall keep a register of its agreements with information and communication technology (ICT) third-party service providers and make it available to its competent authority upon request.
• Enhanced contracts. IT contracts, especially for critical functions, must provide for audit and access rights, security requirements, incident notification and exit strategies.
• Monitoring of critical service providers. IT service providers deemed critical for the sector are designated at European level and placed under the direct supervision of the European Supervisory Authorities (EBA for banking, ESMA for markets, EIOPA for insurance).

Points to note

• Concentration risk depending on a small number of providers, often the same major cloud players, creates a collective vulnerability.
• Exit strategies — being able to change service provider, or bring activities back in-house, without any disruption to business.
• The quality of the register and documentation — often underestimated, it determines the ability to respond to the supervisor.
• Proportionality is not an exemption — the smallest structures have reduced obligations, not none.

The main stages of the calendar

• 14th December 2022 — adoption of the regulations.
• 16 January 2023 — commencement date.
• 2024-2025 — gradual adoption of regulatory technical standards (RTS) and implementing technical standards (ITS).
• 17 January 2025 - full and proper application.
• 2025 - designation of critical ICT third-party service providers and the establishment of their European oversight.
• Every year, around 30 April — forwarding of the IT agreements register to the competent authority.

How to prepare?

• map IT service providers and the functions they support; ;
• compile and keep up to date the register of agreements, with a view to annual transmission; ;
• review the contractual clauses (audit, security, notification, exit) of critical contracts; ;
• set up a major incident detection and notification system; ;
• define and execute a resilience testing plan tailored to the entity's profile; ;
• ensure that the governing body is informed and actively oversees the system.

Actions to be tailored to the profile, size and business model of each organisation.