Digital Operational Resilience and critical facilities

In order to achieve a high common level of digital operational resilience, the DORA sets forth requirements for financial entities in the following areas:

• ICT risk management, covering a sound, comprehensive and well-documented ICT risk management framework, appropriate and reliable ICT systems, protocols and tools, means for identifying ICT risks, protection and prevention as well as a response and recovery framework.
• Reporting of major ICT-related incidents, major operational or security payment-related incidents, and notifying, on a voluntary basis, significant cyber threats.
• Digital operational resilience testing, incl. vulnerability assessments and scans, open-source analyses, network security assessments, gap analyses, physical security reviews, questionnaires and scanning software solutions, source code reviews where feasible, scenario-based tests, compatibility testing, performance testing, end-to-end testing and threat-led penetration testing.
• Information and intelligence sharing in relation to cyber threats and vulnerabilities.
• Measures for the sound management of ICT third-party risk for ICT services, in particular (sub-)outsourcing risks. ICT services are digital and data services provided through ICT systems to one or more internal or external users on an ongoing basis, including hardware as a service and hardware services, excluding traditional analogue telephone services.

Exemptions apply inter alia for small and non-interconnected investment firms as well as microenterprises.

Financial entities shall manage ICT third-party risk as an integral component within their ICT risk management framework. Key principles apply and key provisions need to be embedded in contractual agreements for ICT services. Those provisions cover a clear and complete description of all functions and ICT services, locations where the contracted or subcontracted functions and ICT services are to be provided and where data is to be processed, clear notice periods and reporting obligations, as well as a full-service level description, including precise quantitative and qualitative performance targets, and exit scenarios.

The DORA also establishes an oversight framework for critical ICT third party service providers. Those service providers shall have in place comprehensive, sound and effective rules, procedures, mechanisms as well as arrangements to manage the ICT risk which it may pose to financial entities.

The European Supervisory Authorities (ESA) shall designate the ICT third-party service providers that are critical for financial entities. Financial entities providing ICT services only to other financial entities or ICT intra-group service providers may e.g. not be qualified critical.

Financial entities shall only make use of the services of an ICT third-party service provider established in a third country which has been designated as critical, if the latter has established a subsidiary in the Union within 12 months following designation as critical. When oversight objectives cannot be attained by means of interacting with such subsidiary, measures may also be taken on any premises located in a third-country which is owned, or used in any way, for the purposes of providing services to EU financial entities.

PreviousNext