News

The DORA regulation decrypted: what you need to know

Published

31 January 2025

Read time

4 minutes

What is DORA?

The DORA or Digital Operational Resilience Act is a regulation adopted by the European Union aimed at strengthening the digital resilience of financial actors, particularly in terms of managing technological risks, cybersecurity, and critical service continuity.

Its main objective is to ensure that the financial sector is able to maintain continuous operationality in the face of computer crises such as cyberattacks or major system failures.

Who is concerned?

Banks and financial institutions

Insurance and reinsurance

Asset managers and pension funds

Market infrastructures, trading platforms, and other financial market participants.

Third-party service providers

Juged critical, especially technology service providers such as publishers, hosts, managed service providers, cloud services, etc.

What are the main measures and obligations?

The DORA regulation defines four key operational requirements to ensure digital resilience. Organisations must conduct an ongoing risk assessment, deploy a comprehensive Business Continuity Plan, carry out regular resilience testing of their systems and maintain proactive vulnerability management.

To ensure digital resilience, DORA imposes three key requirements. Management must be actively involved in risk management, guaranteeing cybersecurity and continuity of services. Regular training on cyber security and incident management must be provided at all levels of the company. Finally, internal audits must be carried out to verify compliance with DORA requirements and the application of security policies.

Managing the risks associated with third-party suppliers is a key element of digital resilience, according to DORA. Financial players need to identify and assess the risks associated with critical service providers, particularly those providing essential technologies. Strict contracts must be drawn up, incorporating cybersecurity and service continuity requirements, with an obligation for providers to comply. Finally, continuous monitoring must be carried out to assess performance and limit the risk of disruption.

An incident is considered major if it leads to significant disruption of financial services or major financial loss, which may also affect customers and partners. Institutions must notify the relevant authorities within 24 to 72 hours of detecting the incident, depending on its severity. Finally, a detailed report must be provided, specifying the impact, the corrective measures put in place and the preventive actions taken to avoid future incidents.

Securing digital assets and systems security involves a number of essential measures. A complete and up-to-date inventory of assets, including software, systems and critical infrastructures, must be maintained. Network segmentation is necessary to isolate sensitive systems and limit the spread of attacks. Strict access control must be applied, incorporating the principle of least privilege and multi-factor authentication. Finally, ongoing maintenance is required to correct vulnerabilities and guarantee a secure environment.

The regulation imposes a detailed framework for managing digital risks and resilience of financial services, in order to ensure the stability and security of the European financial sector against cyber threats and other disruptions.

Sanctions in case of non-compliance with DORA

Personal sanctions against the leader

Leaders expose themselves to personal responsibility in the event of non-compliance with the DORA regulations. They may be subject to individual sanctions if their company does not meet the requirements for digital security and resilience.

Learn more about the responsibility of leaders.

Dissuasive financial sanctions

Financial sanctions are determined by each member state of the European Union. However, the regulation requires that these penalties meet three criteria: they must be effective in ensuring compliance with standards, proportionate to the seriousness of the breaches, and sufficiently deterrent to prevent any violations.