+49 (0) 30-555 780 10
The Digital Operational Resilience Act (DORA) is set to transform the financial sector’s approach to cybersecurity and operational risk management. Passed by the European Union as Regulation (EU) 2022/2554, DORA is designed to strengthen the digital operational resilience of financial entities across Europe. It ensures that the financial sector, including banks, insurance companies, investment firms, and critical third-party service providers, is well-equipped to handle ICT (Information and Communication Technology) risks, including cyber threats.
With DORA coming into full effect on January 17, 2025, financial institutions must now prepare to comply with its stringent requirements. But what exactly is DORA, and how will it affect businesses across the financial sector?
DORA is a comprehensive regulatory framework that aims to enhance the digital operational resilience of financial entities within the EU. It does this by focusing on six core areas:
DORA applies to a wide range of entities within the EU financial sector. This includes:
Furthermore, DORA also affects ICT third-party service providers that supply critical digital services to financial entities, such as cloud platforms, data management services, and cybersecurity vendors. These providers will be subject to direct regulatory oversight if they are deemed critical to the financial ecosystem.
DORA addresses the increasing reliance of the financial sector on digital technologies, which makes institutions vulnerable to cyber-attacks, IT failures, and operational disruptions. Financial services are critical to the economy, and disruptions can have widespread consequences, from financial losses to reputational damage.
The COVID-19 pandemic highlighted the importance of digital resilience, as remote work, online banking, and digital financial transactions became more prevalent. In this context, DORA ensures that the financial sector can maintain business continuity and operational stability, even in the face of growing ICT risks.
Furthermore, with the rise of cybercrime and the sophistication of cyber-attacks, regulatory bodies have recognized the need for more rigorous, standardized measures to protect financial systems. DORA is designed to provide the regulatory framework necessary to enforce these protections.
With DORA’s implementation date approaching, financial institutions must act now to ensure compliance. Here are some key steps to prepare:
Implementing DORA’s requirements will require significant investment in technology solutions that enhance cybersecurity, risk management, and incident reporting. While financial institutions need to focus on robust ICT risk management, ensuring that third-party suppliers remain compliant is equally critical. Supplier management platforms like Relatico help streamline the process by simplifying document and certification tracking.
With Relatico, suppliers can easily upload necessary documents and certificates, allowing institutions to maintain a clear overview of what is missing or needs updating. This ensures readiness for audits and compliance checks, reducing the complexity of staying aligned with DORA's stringent third-party requirements. By maintaining complete and up-to-date records, financial institutions can ensure smoother audits and faster compliance processes.
As financial institutions gear up for the January 2025 deadline, DORA represents a major shift in how the sector approaches digital operational resilience. By introducing standardized regulations for ICT risk management, incident reporting, and third-party oversight, DORA ensures that the financial system is better equipped to handle the growing threats in today’s digital age.
For businesses across the financial sector, the time to act is now. Leveraging solutions like Relatico to manage supplier documents and certifications can simplify the compliance process, ensuring that your institution is always audit-ready and aligned with DORA’s requirements.
Bernd possesses extensive experience in strategic procurement, shaped by his tenure at Eckes-Granini, Symrise and DuPont de Nemours. Currently, he is focused on sustainable sourcing and supply chains, collaborating with the relatico team to develop practical software solutions. Additionally, Bernd runs his own agricultural business and is involved in supply chain projects globally.
