DORA’s six pillars

1. Crucially important in this compliance process is the role of the Board of Directors, which not only has the purpose of defining a strategy for managing ICT-related risks, but will also have to maintain an active role in the administration of these risks, including the reporting it will receive (at least once per year) from the head of IT regarding the outcomes and evidences of the resilience tests performed. There is also a training requirement on cyber-security for the entire company population (employees, managers and administrators).
2. In order to ensure adequate risk management, the legislator introduces some specific requirements for financial entities, impacting both infrastructures (e.g. implement resilient ICT tools and systems and ensure adequate protection measures, carry out continuous detections of cybersecurity threats, …) and corporate policies and procedures (e.g. business continuity, disaster recovery, backup and recovery, operational and digital resilience).
3. Regarding ICT services provided by third parties, continuous and comprehensive risk monitoring is required at all stages of the contractual relationship, from pre-contractual (e.g. due diligence on potential suppliers) to “business as usual” (e.g., periodic audits on ICT outsourcers, maintenance of a register of all existing contractual agreements, assesment on contracts, …). There are also specific elements and minimum terms to be included in all ICT outsourcing contracts. Third-party providers of critical ICT services are supervised by the Supervisory Authorities, who can request in any time the transmission of all the necessary information (business or operational documents, contracts, incident reports, audit reports, …) to fulfil its control duties.
4. An incident monitoring, managing and reporting process must be developed including the process of incidents detection (with the support of early warning indicators) and the subsequent classification of such incidents according to the criteria described in the regulation. There is also an additional obligation to report incidents classified as critical to the Supervisory Authorities and to communicate them to internal and external stakeholders, consistently with the communication plans developed ex-ante by a specific corporate figure (the designation of which is part of DORA’s provisions).
5. One of the major innovations introduced by DORA concerns the requirement to plan and carry out periodic threat-based penetration tests aimed to identify any weakness so that appropriate corrective measures can be implemented. Addition operational resilience tests are required for functions that are considered critical or important; they must be repeated at least every three years, as well as following any major incident or significant system change.
6. Finally, a European information exchange mechanism regarding cyber threats is introduced, with the aim of facilitating “systemic” collaboration between financial entities that can reduce the propagation of threats in the financial universe, strengthening overall defence capability and resilience. Joining such mechanism is discretionary.