{"id":14837,"date":"2020-12-18T15:51:32","date_gmt":"2020-12-18T14:51:32","guid":{"rendered":"https:\/\/www.riskinsight-wavestone.com\/?p=14837"},"modified":"2020-12-18T16:03:09","modified_gmt":"2020-12-18T15:03:09","slug":"decrypting-dora-what-does-it-mean-for-resilience-of-financial-organisations","status":"publish","type":"post","link":"https:\/\/www.riskinsight-wavestone.com\/en\/2020\/12\/decrypting-dora-what-does-it-mean-for-resilience-of-financial-organisations\/","title":{"rendered":"Decrypting DORA: what does it mean for Resilience of financial organisations?"},"content":{"rendered":"

With the release of the Digital Operational Resilience Act (DORA), the European Union is taking a strong stan<\/span>d<\/span>\u00a0to strengthen<\/span>\u00a0the financial sector\u2019s<\/span>\u00a0resilience to ICT<\/span>-related<\/span>\u00a0major incidents. With prescriptive requirements on both financial entities and critical ICT services provider, and an aggressive timeline for compliance (estimated at the end of 2022), organisations must start planning now.\u00a0<\/span>\u00a0<\/span><\/p>\n

\n

Why Digital Operational Resilience Act (DORA)?<\/h2>\n

DORA is p<\/span>art of\u00a0<\/span>an\u00a0<\/span>EU-wide \u201cDigital Finance Package\u201d, aimed at\u00a0<\/span>making sure the financial sector can\u00a0<\/span>levera<\/span>ge<\/span>\u00a0opportunities brought by technology<\/span>\u00a0and innovation<\/span>\u00a0whilst mitigating\u00a0<\/span>the\u00a0<\/span>new risks<\/span>\u00a0associated.<\/span>\u00a0<\/span>This package involves regulation on crypto assets, blockchain technology, and digital operational resilience.\u00a0<\/span>\u00a0<\/span><\/p>\n

With\u00a0<\/span>the Digital Operational Resilience Act<\/span>, the EU aims to make sure financial organisations mitigate the risks arising from increasing reliance on ICT systems and third parties for critical operations<\/span>. Organisations<\/span>\u00a0need to be able\u00a0<\/span>to\u00a0<\/span>\u201c<\/span>withstand, respond and recover<\/span>\u201d<\/span>\u00a0from\u00a0<\/span>the\u00a0<\/span>impacts of ICT incidents<\/span>, thereby continuing to deliver\u00a0<\/span>critical and important functions\u00a0<\/span>and minimising<\/span>\u00a0disruption for customers and for the financial system.<\/span>\u00a0<\/span><\/b>This means establishing\u00a0<\/span>robust\u00a0<\/span>measures and controls on systems<\/span>,\u00a0<\/span>tools<\/span>\u00a0and third parties,<\/span>\u00a0<\/span>having the right continuity plans in place, and testing their effectiveness.\u00a0<\/span>\u00a0<\/span><\/p>\n

This global, large scope regulation\u00a0<\/span>is coming in<\/span>\u00a0to rationalise an increasingly fragmented regulatory landscape on the topic<\/span>, with a number of\u00a0<\/span>local regulatory initiatives\u00a0<\/span>in member states\u00a0<\/span>and smaller scope EU guidelines\u00a0<\/span>on related topics (e.g. testing requirements,\u00a0<\/span>management of ICT third party dependencies<\/span>, cyber resilience<\/span>)<\/span>.<\/span>\u00a0Setting up a global regulatory framework will\u00a0<\/span>ensure<\/span>\u00a0there are no overlaps or gaps in regulation and\u00a0<\/span>maintain good conditions for<\/span>\u00a0<\/span>competition in the single market.<\/span>\u00a0<\/span>\u00a0<\/span><\/p>\n

DORA\u00a0<\/span>also\u00a0<\/span>fits into\u00a0<\/span>a\u00a0<\/span>worldwide\u00a0<\/span>trend\u00a0<\/span>in regulation on resilience<\/span>\u00a0for the financial sector<\/span><\/a>,\u00a0<\/span>pioneered by the\u00a0<\/span>Bank of England<\/span>\u2019s\u00a0<\/span>(FCA and PRA)\u00a0<\/span>consultation papers<\/span><\/a>\u00a0on operational resilience and impact tolerances, and\u00a0<\/span>followed<\/span>\u00a0by<\/span>\u00a0principle-based papers\u00a0<\/span>on operational resilience\u00a0<\/span>from the\u00a0<\/span>Bank of International Settlements<\/span>\u00a0(BIS)<\/span><\/a>\u00a0and the\u00a0<\/span>Federal Reserve<\/span><\/a>.\u00a0<\/span>\u00a0<\/span><\/p>\n

\n

DORA in a nutshell: what does it change?<\/h2>\n

Contrary to the FCA\/PRA<\/span>, the Federal Reserve<\/span>\u00a0and the BIS,\u00a0<\/span>DORA focuses on\u00a0<\/span>solely\u00a0<\/span>resilience to I<\/span>CT-related incidents and\u00a0<\/span>introduces very specific and prescriptive requirements. It is not just a set of guidelines but rather criteria, templates and\u00a0<\/span>instructions that will shape how financial organisations manage ICT risk. It demonstrates that EU regulators want to be very hands-on\u00a0<\/span>on<\/span>\u00a0th<\/span>e<\/span>\u00a0topic, with a lot of reporting, communication and assessments that need to happen frequently<\/span>,<\/span>\u00a0enabled by standardised MI and reporting.\u00a0<\/span>\u00a0<\/span><\/p>\n

DORA<\/span>\u00a0<\/span>introduces requirements<\/span>\u00a0across\u00a0<\/span>five pillars:\u00a0<\/span>\u00a0<\/span><\/p>\n