DORA establishes the principles and procedures that financial organizations must follow to protect their networks and information systems.
Regulation (EU) 2022/2554, approved by the European Parliament and the Council on 14 December 2022, introduces a comprehensive regulatory framework aimed at improving the digital operational resilience of financial entities in the European Union. This regulation, known by its English acronym DORA (Digital Operational Resilience Act), establishes the principles and procedures that financial organizations must follow to protect their networks and information systems. Its enactment responds to the need to mitigate the risks that digital dependence imposes on the financial sector, a lesson learned after the 2008 economic crisis.
One of the most relevant points addressed by the regulation in its initial recitals is the need to ensure that European infrastructure remains accessible and is managed efficiently, while promoting interoperability between different systems and organizations. Furthermore, the DORA framework highlights the importance of research and innovation to strengthen the economic competitiveness of the European Union, emphasizing cooperation among Member States to promote a more robust and equitable financial environment.
A key aspect of the regulation is the obligation to involve all stakeholders, both public and private, in the creation and implementation of policies, ensuring that decisions reflect the needs of all organizations participating in this financial ecosystem.
The DORA Regulation is organized into nine chapters that address five main thematic areas. These areas range from the management of risks related to information and communication technologies (ICT), to incident reporting, operational resilience testing, and the supervision of risks associated with reliance on external service providers.
DORA aims to unify and update the requirements related to the management of ICT risk, which until now had been addressed separately in different European Union regulations. With this regulation, the goal is to establish a coherent and unified approach that integrates all regulatory provisions related to digital risk into a single legislative instrument.
Among its objectives, DORA seeks to address deficiencies and gaps that existed in previous legislation, harmonizing terminology and establishing specific rules to improve ICT risk management, incident reporting and monitoring, and the execution of operational resilience tests. In this way, the regulation not only increases awareness of the importance of digital risk but also strengthens the stability of financial entities, recognizing that a lack of digital resilience can compromise the viability of the entire financial system.
This regulation has a broad scope, covering various entities in the financial sector within the European Union. These include:
Banking entities
Including both commercial and investment banks.
Insurance companies
Responsible for offering coverage against various risks.
Investment fund managers
Administrators of collective portfolios.
Securities firms
Involved in financial intermediation.
Electronic trading platforms
Facilitators of financial asset trading.
Providers of securities clearing and settlement services
Responsible for the settlement of securities transactions.
Credit rating agencies
Entities that issue ratings on the financial solvency of institutions and issuers.
DORA introduces a set of rules designed to ensure that financial entities are capable of withstanding and recovering from potential incidents affecting their digital infrastructure. To support organizations in this adaptation process, we offer a specialized Gap Analysis service and the development of a personalized Action Plan. This detailed process will help companies identify areas for improvement and implement the necessary measures to comply with the regulation's requirements.
Our service is designed to adapt to the specific needs of each organization, ensuring an approach tailored to each client's particular reality.
Phase I: Gap Analysis
The first step is a project kick-off meeting in which the logistical aspects of the project will be established and any questions that may arise will be resolved. Subsequently, a detailed analysis of the organization's level of compliance with the requirements established by DORA will be carried out.
The Gap Analysis will focus on reviewing key aspects such as ICT risk management, internal audits, and operational continuity plans. During this phase, existing documentation will be evaluated and potential gaps that need to be addressed to comply with the regulation will be identified.
Phase II: Action Plan
Based on the findings of the Gap Analysis, we will prepare a detailed report that will include a corrective Action Plan. This report will not only identify the areas where the organization does not comply with DORA but will also provide specific recommendations to address the deficiencies found. The implementation of the plan will be monitored to ensure effective compliance before the final deadline.
Documentation delivered
During the course of the project, we will deliver the following documentation:
- Phase I: Project kick-off presentation and assessment of DORA applicability.
- Phase II: Analysis report and Action Plan, including details on requirements, documentary evidence, stakeholders, and compliance status.
Closing meeting
At the end of the project, we will organize a closing meeting in which the results will be discussed and any final questions that may arise will be resolved. This formal closure will mark the full completion of the contractual obligations and ensure that the organization is prepared to face the challenges of digital operational resilience.
