Stay resilient and compliant with comprehensive IT visibility

DORA is an EU regulation aimed at strengthening the digital operational resilience of financial entities. It applies to 21 types of financial institutions, including banks, insurance companies, investment firms and payment service providers, as well as their ICT third-party providers​.

DORA establishes five main pillars of compliance:

• ICT risk management—Organizations must implement robust frameworks to identify, prevent and mitigate ICT-related risks
   
• Incident reporting—Financial entities must detect, manage and report significant cyber incidents to regulators
   
• Digital operational resilience testing—Regular testing, including penetration testing, is required to evaluate the resilience of ICT systems
   
• Third-party risk management—Entities must monitor and manage risks associated with ICT service provider

​

DORA extends compliance obligations to third-party ICT providers, such as cloud service providers and software vendors. These entities must ensure they meet cybersecurity standards, undergo audits, and provide financial entities with contractual assurances of resilience. Critical ICT service providers may be directly supervised by EU regulators​.

Non-compliance with DORA can lead to administrative sanctions, fines and enforcement actions by national regulators. The penalties vary depending on the severity of the breach and may include restrictions on operations or financial penalties proportional to the entity’s turnover​.

Organizations can prepare for NIS2 compliance by implementing a structured cybersecurity framework that should include the following steps:

• Implement cybersecurity risk management
• Establish incident reporting and response plan
• Ensure business continuity and disaster recovery
• Train employees and create awareness
• Document compliance and prepare for audits
• Monitor and adapt to emerging threats​

NIS2 is a law that applies to all medium and large organizations within vital sectors of the EU, including healthcare, transportation, banking and financial markets, digital infrastructure, energy and more. It aims to enhance and strengthen the cyber resilience of these organizations. 

NIS2 charges these organizations with a duty of care that requires them to: 

• Identify critical business processes, conduct risk assessments and take appropriate measures to manage risks, prevent incidents and effectively respond when cybersecurity incidents occur
• Notify their supervisory authority of a significant incident within 24 hours of its occurrence
• Submit an incident report within 72 hours and a final report within one month

When evaluating the incident’s significance, the organization must consider the degree of operational disruption to services or financial losses to the organization, the number of affected users, the duration of the incident and the geographical scope of the incident.

The final report must include a detailed description of the incident, including the severity and consequences, the incident’s root cause, risk mitigation measures and possible cross-border consequences.

The organization’s supervisory authority can impose sanctions on the non-compliant organizations. These sanctions may include imposing fines, removing directors from their offices and other consequences. 

Organizations can prepare for NIS2 compliance by implementing a structured cybersecurity framework that should include the following steps:

1. Implement Cybersecurity Risk Management
2. Establish Incident Reporting & Response Plan
3. Ensure Business Continuity & Disaster Recovery
4. Train Employees & Create Awareness
5. Document Compliance & Prepare for Audits
6. Monitor and Adapt to emerging threats