{"id":7056,"date":"2025-01-10T09:38:14","date_gmt":"2025-01-10T08:38:14","guid":{"rendered":"https:\/\/ibj.be\/?p=7056"},"modified":"2025-01-21T09:44:08","modified_gmt":"2025-01-21T08:44:08","slug":"whos-not-ready-for-dora","status":"publish","type":"post","link":"https:\/\/ibj.be\/nl\/partnerblog\/whos-not-ready-for-dora\/","title":{"rendered":"Who\u2019s (not) ready for DORA?"},"content":{"rendered":"\n<p class=\"wp-block-paragraph\">Over the last few years, the EU has been very active in updating its overall security framework. First, the <a href=\"https:\/\/eur-lex.europa.eu\/eli\/dir\/2022\/2555\/oj\">NIS2 Directive<\/a> aims to strengthen the cybersecurity posture of a whole range of important and essential entities across different sectors. Second, the <a href=\"https:\/\/eur-lex.europa.eu\/eli\/dir\/2022\/2557\/oj\">Critical Entities Directive<\/a> aims to boost the overall resilience of critical entities, the list of which overlaps largely with the NIS2 Directive. Third, the Digital Operational Resilience Act (<a href=\"https:\/\/eur-lex.europa.eu\/eli\/reg\/2022\/2554\/oj\">DORA<\/a>) focuses on the digital operational resilience of the financial sector. Last, the recently approved <a href=\"https:\/\/eur-lex.europa.eu\/legal-content\/EN\/TXT\/PDF\/?uri=CONSIL:PE_100_2023_REV_1\">Cyber Resilience Act<\/a> will impose specific cybersecurity requirements on products with digital elements.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">In this blogpost, we will focus on DORA, which will become applicable from 17 January 2025.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>Why DORA?<\/strong><\/p>\n\n\n\n<p class=\"wp-block-paragraph\">DORA is largely a cybersecurity framework. Why did we need another one if the NIS2 Directive was just adopted? While NIS2 will indeed become the core EU cybersecurity framework, its article 4 does allow for sector-specific acts to be adopted. Where such is the case, the <strong>sector-specific act takes precedence over NIS2<\/strong> \u2013 thus becoming a <em>lex specialis <\/em>to NIS2\u2019s <em>lex generalis<\/em>. Sector-specific acts can be better suited to take full account of the specificities and complexities of the sectors concerned.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Article 1(2) DORA identifies DORA as such <strong>sector-specific act<\/strong>. Financial entities identified as essential or important entities under the NIS2 framework will therefore primarily have to comply with DORA instead of NIS2.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">DORA addresses a number of <strong>regulated entities<\/strong> in the financial sector. Concretely, it applies to the following entities:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>credit institutions;<\/li>\n\n\n\n<li>payment institutions, including exempted payment institutions;<\/li>\n\n\n\n<li>account information service providers;<\/li>\n\n\n\n<li>electronic money institutions, including exempted electronic money institutions;<\/li>\n\n\n\n<li>investment firms;<\/li>\n\n\n\n<li>crypto-asset service providers under MiCAR;<\/li>\n\n\n\n<li>central securities depositories;<\/li>\n\n\n\n<li>central counterparties;<\/li>\n\n\n\n<li>trading venues;<\/li>\n\n\n\n<li>trade repositories;<\/li>\n\n\n\n<li>managers of alternative investment funds;<\/li>\n\n\n\n<li>management companies;<\/li>\n\n\n\n<li>data reporting service providers;<\/li>\n\n\n\n<li>insurance and reinsurance undertakings;<\/li>\n\n\n\n<li>insurance intermediaries, reinsurance intermediaries and ancillary insurance intermediaries;<\/li>\n\n\n\n<li>institutions for occupational retirement provision;<\/li>\n\n\n\n<li>credit rating agencies;<\/li>\n\n\n\n<li>administrators of critical benchmarks;<\/li>\n\n\n\n<li>crowdfunding service providers;<\/li>\n\n\n\n<li>securitisation repositories.<\/li>\n<\/ul>\n\n\n\n<p class=\"wp-block-paragraph\">This addresses a very <strong>large portion of the regulated financial services market<\/strong>. However, there are still a few entities that are not covered at the moment. Moreover, DORA also foresees in a few exemptions and deviations for microenterprises and SMEs.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>How to prepare for DORA?<\/strong><\/p>\n\n\n\n<p class=\"wp-block-paragraph\">DORA focuses on the operational integrity and reliability of financial services, by ensuring that adequate ICT-related capabilities are in place to address the security of the network and information systems used by financial service providers. To attain this, regulated financial entities will need to address a few points:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>ICT risk management:<\/strong> A comprehensive set of key policies and principles must be in place to manage ICT-related risks. This should be approached from all angles, including ICT-risks, human resources, access control, anomaly detection, ICT-resources mapping, change control, business continuity and disaster recovery, with documentation and regular follow-up.<\/li>\n\n\n\n<li><strong>ICT incident management, classification and reporting:<\/strong> All ICT-related incidents and major threats will need to be classified. Adequate procedures must be in place to monitor, handle and resolve incidents. Impacts of incidents will need to be assessed and root causes will need to be analyzed and mitigated. Streamlined reporting to the competent authorities must be in place, as well as communication to the public in certain cases.<\/li>\n\n\n\n<li><strong>Digital operational resilience testing:<\/strong> Regular testing will need to be performed on ICT systems, with some more critical entities subject to regular threat-led penetration testing (TLPT).<\/li>\n\n\n\n<li><strong>Cyber-threat information sharing:<\/strong> DORA provides a framework for the voluntary sharing of cyber-threat information between regulated financial entities, in line with the TIBER-EU framework.<\/li>\n<\/ul>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>Don\u2019t forget about the ICT third-party service providers!<\/strong><\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Even if you are not a regulated financial entity, DORA may still be applicable to you <strong>indirectly<\/strong>. A service provider that provides ICT services to financial entities subject to DORA will be considered as an ICT third-party service provider. This has a number of implications.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">First, financial entities will need to adopt an <strong>ICT outsourcing policy<\/strong>, in which they describe the type of services they are willing to outsource, their risk assessment, their criteria for selecting a service provider, an exit policy, etc. Moreover, they will need to carefully assess their <strong>concentration risk<\/strong>, which arises if they become too dependent on a single or a limited number of service providers.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Second, <strong>contracts<\/strong> with ICT third-party service providers must comply with a number of requirements. Article 30 DORA lists a number of general requirements that apply to all cases of ICT outsourcing, but also includes a number of more specific requirements that only apply when outsourcing critical or important functions.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>The result of this is that every contract a financial entity has with an ICT third-party service provider will need to be revised in order to comply with these requirements.<\/strong> This can be a complex exercise that requires a careful balancing of the parties\u2019 rights and interests with the requirements of DORA.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Last, some ICT third-party service providers may be considered as <strong>critical ICT third-party service providers<\/strong>. This is the case if they are so important for the financial sector that an operational failure on their end could have a systemic impact on the stability, continuity or quality of the provision of financial services. These entities will be designated and supervised by the European Supervisory Authorities.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>Is everyone ready yet?<\/strong><\/p>\n\n\n\n<p class=\"wp-block-paragraph\">The Belgian regulator FSMA has been conducting <a href=\"https:\/\/www.fsma.be\/en\/news\/launch-second-dora-awareness-survey\">surveys<\/a> on the <strong>preparedness<\/strong> of the financial sector for DORA. The first wave revealed that quite a few entities \u2013 particularly in the insurance sector \u2013 were either not aware of their obligations under DORA, or not adequately prepared for DORA yet.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Most financial entities were found to already have an ICT risk assessment and management framework in place, which would put them in a better position to prepare for DORA. High awareness and preparedness were also noted in terms of business continuity management. <strong>Incident response and testing<\/strong>, however, were points that still required major improvements by a large number of respondents. Also <strong>ICT third-party service provider risks<\/strong> were still significantly unmanaged.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">A similar <a href=\"https:\/\/www.cssf.lu\/wp-content\/uploads\/Results-of-DORA-readiness-survey.pdf\">survey<\/a> by the Luxembourgish regulator CSSF showed a more positive result, with a much higher perceived readiness \u2013 although also here <strong>ICT third-party risk management <\/strong>remained the biggest obstacle. This survey was conducted a few months later than the first FSMA survey, so this may also indicate that entities have been using 2024 wisely for their preparation.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>Nevertheless, these results show that there is still work to be done, particularly in getting those contractual frameworks with ICT third-party service providers updated.<\/strong><\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Author:&nbsp;<a href=\"https:\/\/www.timelex.eu\/en\/team\/niels-vandezande\">Niels Vandezande<\/a>, Timelex<\/p>\n","protected":false},"excerpt":{"rendered":"<p>Over the last few years, the EU has been very active in updating its overall security framework. <\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"footnotes":""},"categories":[63],"tags":[],"class_list":["post-7056","post","type-post","status-publish","format-standard","hentry","category-partnerblog"],"acf":[],"yoast_head":"<!-- This site is optimized with the Yoast SEO plugin v28.7 - https:\/\/yoast.com\/product\/yoast-seo-wordpress\/ -->\n<title>Who\u2019s (not) ready for DORA? - IBJ - IJE<\/title>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/ibj.be\/nl\/partnerblog\/whos-not-ready-for-dora\/\" \/>\n<meta property=\"og:locale\" content=\"nl_NL\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"Who\u2019s (not) ready for DORA? - IBJ - IJE\" \/>\n<meta property=\"og:description\" content=\"Over the last few years, the EU has been very active in updating its overall security framework.\" \/>\n<meta property=\"og:url\" content=\"https:\/\/ibj.be\/nl\/partnerblog\/whos-not-ready-for-dora\/\" \/>\n<meta property=\"og:site_name\" content=\"IBJ - IJE\" \/>\n<meta property=\"article:published_time\" content=\"2025-01-10T08:38:14+00:00\" \/>\n<meta property=\"article:modified_time\" content=\"2025-01-21T08:44:08+00:00\" \/>\n<meta name=\"author\" content=\"ronnyvanderborght\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:label1\" content=\"Geschreven door\" \/>\n\t<meta name=\"twitter:data1\" content=\"ronnyvanderborght\" \/>\n\t<meta name=\"twitter:label2\" content=\"Geschatte leestijd\" \/>\n\t<meta name=\"twitter:data2\" content=\"5 minuten\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\\\/\\\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"https:\\\/\\\/ibj.be\\\/nl\\\/partnerblog\\\/whos-not-ready-for-dora\\\/#article\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/ibj.be\\\/nl\\\/partnerblog\\\/whos-not-ready-for-dora\\\/\"},\"author\":{\"name\":\"ronnyvanderborght\",\"@id\":\"https:\\\/\\\/ibj.be\\\/nl\\\/#\\\/schema\\\/person\\\/13a90897df17a00fd7ba7cc501d0496c\"},\"headline\":\"Who\u2019s (not) ready for DORA?\",\"datePublished\":\"2025-01-10T08:38:14+00:00\",\"dateModified\":\"2025-01-21T08:44:08+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\\\/\\\/ibj.be\\\/nl\\\/partnerblog\\\/whos-not-ready-for-dora\\\/\"},\"wordCount\":1072,\"articleSection\":[\"Partnerblog\"],\"inLanguage\":\"nl-NL\"},{\"@type\":\"WebPage\",\"@id\":\"https:\\\/\\\/ibj.be\\\/nl\\\/partnerblog\\\/whos-not-ready-for-dora\\\/\",\"url\":\"https:\\\/\\\/ibj.be\\\/nl\\\/partnerblog\\\/whos-not-ready-for-dora\\\/\",\"name\":\"Who\u2019s (not) ready for DORA? - IBJ - IJE\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/ibj.be\\\/nl\\\/#website\"},\"datePublished\":\"2025-01-10T08:38:14+00:00\",\"dateModified\":\"2025-01-21T08:44:08+00:00\",\"author\":{\"@id\":\"https:\\\/\\\/ibj.be\\\/nl\\\/#\\\/schema\\\/person\\\/13a90897df17a00fd7ba7cc501d0496c\"},\"breadcrumb\":{\"@id\":\"https:\\\/\\\/ibj.be\\\/nl\\\/partnerblog\\\/whos-not-ready-for-dora\\\/#breadcrumb\"},\"inLanguage\":\"nl-NL\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\\\/\\\/ibj.be\\\/nl\\\/partnerblog\\\/whos-not-ready-for-dora\\\/\"]}]},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\\\/\\\/ibj.be\\\/nl\\\/partnerblog\\\/whos-not-ready-for-dora\\\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\\\/\\\/ibj.be\\\/nl\\\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"Who\u2019s (not) ready for DORA?\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\\\/\\\/ibj.be\\\/nl\\\/#website\",\"url\":\"https:\\\/\\\/ibj.be\\\/nl\\\/\",\"name\":\"IBJ - IJE\",\"description\":\"\",\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\\\/\\\/ibj.be\\\/nl\\\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"nl-NL\"},{\"@type\":\"Person\",\"@id\":\"https:\\\/\\\/ibj.be\\\/nl\\\/#\\\/schema\\\/person\\\/13a90897df17a00fd7ba7cc501d0496c\",\"name\":\"ronnyvanderborght\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"nl-NL\",\"@id\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/cd2dd4863bbc8a3842b2f208c00ab3f9e01ffaa16b26a93a19a3cdc637b7efe5?s=96&d=mm&r=g\",\"url\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/cd2dd4863bbc8a3842b2f208c00ab3f9e01ffaa16b26a93a19a3cdc637b7efe5?s=96&d=mm&r=g\",\"contentUrl\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/cd2dd4863bbc8a3842b2f208c00ab3f9e01ffaa16b26a93a19a3cdc637b7efe5?s=96&d=mm&r=g\",\"caption\":\"ronnyvanderborght\"},\"sameAs\":[\"https:\\\/\\\/ibj.be\"]}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"Who\u2019s (not) ready for DORA? - IBJ - IJE","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/ibj.be\/nl\/partnerblog\/whos-not-ready-for-dora\/","og_locale":"nl_NL","og_type":"article","og_title":"Who\u2019s (not) ready for DORA? - IBJ - IJE","og_description":"Over the last few years, the EU has been very active in updating its overall security framework.","og_url":"https:\/\/ibj.be\/nl\/partnerblog\/whos-not-ready-for-dora\/","og_site_name":"IBJ - IJE","article_published_time":"2025-01-10T08:38:14+00:00","article_modified_time":"2025-01-21T08:44:08+00:00","author":"ronnyvanderborght","twitter_card":"summary_large_image","twitter_misc":{"Geschreven door":"ronnyvanderborght","Geschatte leestijd":"5 minuten"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/ibj.be\/nl\/partnerblog\/whos-not-ready-for-dora\/#article","isPartOf":{"@id":"https:\/\/ibj.be\/nl\/partnerblog\/whos-not-ready-for-dora\/"},"author":{"name":"ronnyvanderborght","@id":"https:\/\/ibj.be\/nl\/#\/schema\/person\/13a90897df17a00fd7ba7cc501d0496c"},"headline":"Who\u2019s (not) ready for DORA?","datePublished":"2025-01-10T08:38:14+00:00","dateModified":"2025-01-21T08:44:08+00:00","mainEntityOfPage":{"@id":"https:\/\/ibj.be\/nl\/partnerblog\/whos-not-ready-for-dora\/"},"wordCount":1072,"articleSection":["Partnerblog"],"inLanguage":"nl-NL"},{"@type":"WebPage","@id":"https:\/\/ibj.be\/nl\/partnerblog\/whos-not-ready-for-dora\/","url":"https:\/\/ibj.be\/nl\/partnerblog\/whos-not-ready-for-dora\/","name":"Who\u2019s (not) ready for DORA? - IBJ - IJE","isPartOf":{"@id":"https:\/\/ibj.be\/nl\/#website"},"datePublished":"2025-01-10T08:38:14+00:00","dateModified":"2025-01-21T08:44:08+00:00","author":{"@id":"https:\/\/ibj.be\/nl\/#\/schema\/person\/13a90897df17a00fd7ba7cc501d0496c"},"breadcrumb":{"@id":"https:\/\/ibj.be\/nl\/partnerblog\/whos-not-ready-for-dora\/#breadcrumb"},"inLanguage":"nl-NL","potentialAction":[{"@type":"ReadAction","target":["https:\/\/ibj.be\/nl\/partnerblog\/whos-not-ready-for-dora\/"]}]},{"@type":"BreadcrumbList","@id":"https:\/\/ibj.be\/nl\/partnerblog\/whos-not-ready-for-dora\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/ibj.be\/nl\/"},{"@type":"ListItem","position":2,"name":"Who\u2019s (not) ready for DORA?"}]},{"@type":"WebSite","@id":"https:\/\/ibj.be\/nl\/#website","url":"https:\/\/ibj.be\/nl\/","name":"IBJ - IJE","description":"","potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/ibj.be\/nl\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"nl-NL"},{"@type":"Person","@id":"https:\/\/ibj.be\/nl\/#\/schema\/person\/13a90897df17a00fd7ba7cc501d0496c","name":"ronnyvanderborght","image":{"@type":"ImageObject","inLanguage":"nl-NL","@id":"https:\/\/secure.gravatar.com\/avatar\/cd2dd4863bbc8a3842b2f208c00ab3f9e01ffaa16b26a93a19a3cdc637b7efe5?s=96&d=mm&r=g","url":"https:\/\/secure.gravatar.com\/avatar\/cd2dd4863bbc8a3842b2f208c00ab3f9e01ffaa16b26a93a19a3cdc637b7efe5?s=96&d=mm&r=g","contentUrl":"https:\/\/secure.gravatar.com\/avatar\/cd2dd4863bbc8a3842b2f208c00ab3f9e01ffaa16b26a93a19a3cdc637b7efe5?s=96&d=mm&r=g","caption":"ronnyvanderborght"},"sameAs":["https:\/\/ibj.be"]}]}},"_links":{"self":[{"href":"https:\/\/ibj.be\/nl\/wp-json\/wp\/v2\/posts\/7056","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/ibj.be\/nl\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/ibj.be\/nl\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/ibj.be\/nl\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/ibj.be\/nl\/wp-json\/wp\/v2\/comments?post=7056"}],"version-history":[{"count":0,"href":"https:\/\/ibj.be\/nl\/wp-json\/wp\/v2\/posts\/7056\/revisions"}],"wp:attachment":[{"href":"https:\/\/ibj.be\/nl\/wp-json\/wp\/v2\/media?parent=7056"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/ibj.be\/nl\/wp-json\/wp\/v2\/categories?post=7056"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/ibj.be\/nl\/wp-json\/wp\/v2\/tags?post=7056"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}