X
January 30, 2025
Security leaders, the DORA Sword of Damocles is no longer hanging over your head; it’s staring up at you from your desk. It’s impossible to ignore, given that it imposes a slim 4-hour window to report major cybersecurity incidents and brawny fines for noncompliance.
DORA, the EU Digital Operational Resilience Act — aka Directive (EU) 2022/2555 of the European Parliament — went into effect on Jan. 17, 2025. The act promises to establish transparency in the EU financial services industry and increase consumer trust in digital payments.
Unfortunately, many companies are still struggling to achieve compliance.
DORA aims to enhance and build the EU’s cybersecurity capabilities and is taking aim at EU financial entities.
As its name implies, DORA aims to enhance the digital operational resilience of financial services companies and their information and communications technology (ICT) providers through a unified framework. DORA — the first regulatory framework to focus on digital resilience across the European financial ecosystem — is designed to mitigate risks and cyber threats in the sector.
The mandates apply to a range of financial entities, including banks, insurance companies, investment firms, crypto-asset service providers and crowdfunding platforms. They’re all on the hot seat: Organizations that fail to comply with the established ICT risk management framework could face significant fines and reputational damage.
Beyond your own company risk profile, you need to ensure that third-party providers such as cloud platforms and data centers — particularly those classified as “critical” — are in compliance with these key processes:
(Companies not in the EU that service EU customers are likely affected as well, particularly if their services could be considered critical to the customer’s business continuity and operational resilience.)
“For those who haven't started, playing catch-up could be a costly mistake,” notes Contrast Security CISO David Lindner.
With the compliance deadline now in the rearview mirror, many financial institutions face challenges adapting to its myriad complexities and strict reporting deadlines. In April 2024, a McKinsey survey found that only about one-third of financial institutions had confidence they could fulfill all DORA regulatory expectations by January 2025. Furthermore, all respondents expected at least some DORA efforts to continue beyond the Jan. 17 deadline.
This same scenario has played out before. Businesses still struggle to meet the EU’s General Data Protection Regulation (GDPR), a 2018 law that protects the privacy and security of personal data. Reports show similar lagging compliance results in the U.S. in response to the Securities and Exchange Commission’s (SEC’s) cyber incident reporting mandates.
“Achieving and maintaining compliance entails taking an entirely new approach to operational practices and demands resource-intensive monitoring, auditing and reporting,” said Richa Gupta, Contrast Security Director of Risk and Compliance. “With the complex changes needing to be made and broad scope such changes must impact, it’s no surprise that financial institutions and their third-party vendors face obstacles in meeting DORA requirements.”
DORA mandates a comprehensive ICT risk management framework, requiring financial institutions to identify, protect, detect, respond to and recover from digital risks. This involves aligning existing frameworks with DORA’s detailed requirements, which can be resource-intensive and complex to implement. As noted above, financial institutions must ensure that critical third-party ICT providers comply with DORA’s operational resilience standards, including enhanced monitoring, contractual clauses and joint testing with providers. Managing these relationships, particularly with large global service providers, is challenging.
Annual recovery testing and vulnerability assessments are also mandatory, which can disrupt operations if not managed carefully. Ensuring these tests are effective without impacting business continuity is a delicate balance. DORA also imposes strict timelines for reporting major ICT incidents – within four hours. (As a note of comparison, the U.S. Securities and Exchange Commission’s (SEC’s) rules require companies to report cyber incidents within four days, which, research has shown, many businesses struggle to meet.) Preparing to meet these deadlines while managing large-scale cyberattacks or disruptions requires significant operational adjustments and robust incident response processes.
Many organizations already struggle with resource limitations and scalability issues, which are exacerbated when implementing DORA’s requirements.
Companies may have tools in place that can help with various aspects of DORA. Static Application Security Testing (SAST), Dynamic Application Security Testing (DAST), Interactive Application Security Testing (IAST), Runtime Application Self-Protection (RASP) and Web Application Firewalls (WAFs), to name a few, conduct continuous monitoring and control of ICT systems, detect anomalous activities, and perform necessary tests, such as vulnerability assessments and scans, network security assessments, performance testing, end-to-end testing and penetration testing.
Application Detection and Response (ADR), in particular, should be part of any organization’s DORA compliance arsenal, given its ability to meet the core requirements for ICT risk management, incident reporting and operational resilience. Here’s a snapshot of how ADR helps achieve DORA compliance:
DORA presents significant challenges for financial institutions, demanding comprehensive risk management, robust incident response, and stringent compliance reporting. While daunting, DORA provides a crucial opportunity to enhance operational resilience and safeguard the EU financial sector from cyber threats. By leveraging advanced security solutions like ADR, organizations can effectively navigate DORA's complexities, meet compliance requirements, and build a more secure and resilient future.
Want to learn more about how Contrast ADR can help your compliance efforts? Book a demo today.
Read more:
