DORA requires more than just good cybersecurity 

DORA for financial institutions

Since January 17, 2025, financial institutions must comply with the Digital Operational Resilience Act (DORA). The European regulation is intended to ensure that banks, insurers, and other financial organizations are better able to withstand cyberattacks and ICT disruptions. But anyone who thinks DORA is solely about technical security measures is mistaken, according to Kirsten, a security consultant at Nestor Security. «DORA goes far beyond cybersecurity alone,« she says. “It actually involves governance, policies, crisis management, and cooperation with suppliers.” 

Digital resilience central 

With DORA, the European Union aims to increase the digital resilience of the financial sector. Organizations must not only take measures to prevent cyberattacks as much as possible, but also detect incidents, respond to them, recover, and limit the impact. The regulation shares similarities with the NIS2 Directive, which is intended to strengthen the digital resilience of vital and important sectors. While NIS2 has a broad target audience, DORA focuses specifically on the financial sector and the law contains detailed requirements for ICT risk management.  

More than a technical issue 

According to Kirsten, many organizations underestimate the impact of the new regulations. “Many companies think they only need to tighten their cybersecurity, but DORA requires much more. It is also about policies, reporting, exercises, and crisis management.” For example, organizations must have a documented process for registering, assessing, and handling ICT incidents. In practice, incident response and recovery plans are often a part of this. Moreover, those plans cannot just gather dust in a drawer: organizations must regularly practice and test them. This involves not only IT staff, but also executives and other key figures within the organization. “You have to bring the right people together to practice scenarios. Ultimately, such an incident affects the entire organization.” 

Suppliers play a key role 

An important part of DORA is managing risks related to third-party ICT providers. Financial institutions have become increasingly dependent on software vendors, cloud providers, and other IT partners. Consequently, an outage or security incident at a single provider can have major consequences for multiple organizations simultaneously. “Everything is interconnected. That is precisely why vendor management has become so important. Organizations must therefore not only have their own security in order, but also map out vendor risks, make contractual agreements, and be prepared for a vendor outage.” 

Practice and report 

DORA also requires organizations to report major ICT incidents to the supervisory authority according to fixed procedures. In addition, they must regularly test their digital resilience. For larger and riskier institutions, these tests can consist of realistic attack scenarios that check how well the organization is able to withstand a targeted cyberattack. Organizations that fail to comply with the obligations may face enforcement measures or sanctions, depending on the competent national supervisory authority. 

ISO 27001 as a starting point 

For organizations that are still at the beginning of their DORA journey, an existing information security management system can provide a good foundation. “ISO 27001 is a great first step,” says Kirsten. “With that, you have already set up many security measures and processes. ISO 27001 therefore offers a solid starting point, but on its own it is not sufficient to fully comply with DORA. The regulation sets additional requirements, including in the areas of ICT risk management, third-party risk management, incident reporting, and digital operational resilience testing.” Which additional measures are necessary depends, among other things, on the size of the organization and the risks it faces. 

An organization-wide responsibility 

Although IT departments play an important role in the implementation of DORA, the responsibility is much broader. Management, compliance, risk management, and other departments must work together to meet the requirements. “It may demand the most from IT, but ultimately it affects the entire organization.” Precisely this is what makes DORA different from what many organizations expect beforehand, according to Kirsten: technology is not central, but rather the way an organization prepares for digital disruptions, responds to them, and guarantees the continuity of its services.

Curious about what DORA means for you? Take Contact Oops!