The financial sector is increasingly dependent on technology and tech companies to deliver financial services, which makes financial entities vulnerable to cyber-attacks or incidents. When not managed properly, information and communication technology (ICT) risks can lead to disruptions of financial services offered across borders. This can have an impact on other companies, sectors and even on the rest of the economy, which underlines the importance of the digital operational resilience of the financial sector.

To deal with this, the EU introduced the Digital Operational Resilience Act (DORA). DORA's aim is to strengthen the IT security of financial entities such as banks, insurance companies and investment firms and ICT third party service providers. The 

 on 16 January 2023 and will apply as of 17 January 2025.

What is the Digital Operational Resilience Act (DORA), and what are the Act's requirements?

DORA is a comprehensive regulatory framework proposed by the European Commission. It seeks to establish a harmonized approach to operational resilience across the European Union (EU). By setting clear expectations for operational resilience, DORA aims to protect consumers, maintain financial stability, and ensure the smooth functioning of digital services.

The Act introduces stringent requirements for firms to manage and mitigate risks related to their digital operations. These include ICT risk management, incident reporting, digital operational resilience testing and more.

Below are DORA's specific requirements, organized into several key components:

Firms must establish robust risk management frameworks that align with DORA's requirements and a control function to oversee ICT risk,

DORA introduces the requirement for financial entities to manage ICT third party risk as an integral component of ICT risk within their ICT risk management framework. The management body must regularly review the risks identified in respect to contractual arrangements on the use of ICT services supporting critical or important functions. The regulation will also implement an oversight framework for critical ICT third-party service providers; these will be designated by the European Supervisory Agencies (ESAs). This potentially extends the scope of DORA beyond outsourcing arrangements to encompass a broad range of IT-related services procured by financial services entities.

 Firms are obligated to promptly report any major ICT-related incidents. The ESAs are developing technical standards to specify the criteria for classifying ICT incidents, materiality thresholds for major incidents, and significant cyber threats.

Testing of digital operational resilience: 

DORA mandates regular testing of digital operational resilience. The ESAs are working on technical standards to provide further details on advanced testing of ICT tools, systems, and processes through threat-led penetration testing (TLPT). These standards will also outline the criteria for identifying financial entities required to perform TLPT.

DORA encourages information sharing among financial entities to foster a collaborative approach to managing digital operational risks. Organizations can collectively enhance their resilience and response capabilities by sharing insights and best practices.

These components form the foundation of DORA, ensuring that financial entities prioritize operational resilience and take proactive measures to mitigate ICT risks. However, as with any regulation, it poses several challenges for organizations to overcome to be fully compliant.

In order to navigate the requirements and expectations of DORA effectively, financial entities must approach compliance with a strategic mindset. This entails taking a proactive approach to compliance and fully understanding the regulation and its requirements.

 DORA encompasses a wide range of requirements and expectations, spanning multiple areas such as risk management, third-party risk, incident reporting, testing, information sharing and more. Each of these components requires careful consideration and implementation to ensure compliance. By starting early, financial entities can allocate sufficient time and resources to thoroughly understand the intricacies of DORA and develop a comprehensive compliance strategy.

Adapting governance structures to align with successful operational resilience:

 Adapting governance structures involves reviewing and potentially revising existing policies, procedures, and decision-making frameworks to align with DORA's requirements. This may include establishing clear lines of responsibility and accountability for operational resilience, defining roles and responsibilities, and implementing robust reporting mechanisms to ensure ongoing compliance. It is crucial to integrate DORA compliance into existing governance frameworks, such as risk management and business continuity, to create a holistic approach to operational resilience.

Identifying connections with current and upcoming regulations:

 DORA does not exist in isolation; it intersects with other existing and upcoming regulations (NIS2, GDPR, MiFID II, PSD3, PSR, Digital Services Act, Digital Markets Act), creating a complex regulatory landscape. Understanding these interconnections is essential for ensuring effective compliance and avoiding duplication of efforts.

Promoting information sharing on cyber threats:

 One of the primary challenges in information sharing is striking the right balance between sharing enough information to be useful for others while protecting sensitive data. Financial entities must ensure that any shared information is appropriately anonymized and aggregated to prevent the identification of specific individuals or organizations. This helps protect the privacy and confidentiality of the parties involved.

Reviewing relationships with ICT service providers:

 DORA mandates that financial entities manage risks associated with their ICT service providers. This includes conducting due diligence, updating contractual agreements, and establishing ongoing monitoring mechanisms, which — when done manually — can take significant resources to conduct properly.

Regularly testing resilience capabilities: 

Ongoing compliance with DORA necessitates regular testing to ensure the maintenance of resilience capabilities.

Developing a culture of operational resilience: 

Developing a culture of operational resilience isn't easy, but it's crucial to ensure that resilience becomes ingrained in the organization's values, mindset and day-to-day operations.

Complying with DORA takes a proactive approach, technology can help

DORA represents a significant regulatory change that businesses must navigate to thrive in the digital age. By proactively adapting to DORA's requirements, organizations can foster transparency, sustainability, and responsible innovation. Compliance with DORA not only mitigates risks but also presents opportunities for growth and competitive advantage.

The right technology can help you streamline processes to get a head start on your DORA compliance initiatives.

Discover more about how Diligent can help your organization comply with DORA and other connected regulations by 

Promoting secure information sharing and managing ICT risks: Key requirements for DORA compliance 

The pandemic pushed us firmly into the digital era, where technology emerged as a source of hope and connection. It was more than a tool; it was a lifeline to vital, trustworthy information and resources directly from our local government. Post-pandemic, technology remains essential in bridging the gap between individuals and their communities, while expectations for seamless access and engagement have only increased.

Local government council members can use this momentum to strengthen ties to the communities they serve and ensure technology continues to empower everyone to move forward together.

Many local governments rely on technology to 

help them earn and keep the trust and engagement of their residents

. For example, Canada’s Municipality of Resolute Bay is so remote that broadband internet only become available in 2022. Municipal officials realized that widespread broadband access could help them increase public engagement and expand participation in council meetings for the hamlet’s 200 residents.

Through the adoption of Diligent Community board management software, Resolute Bay posts agendas and minutes for council meetings online. Residents can sign up for alerts that let them know when the next meeting is held.

“Once the agenda is published online, there is greater awareness in the community and beyond. We have community members subscribing to the new service so that they are informed when the next council meeting will take place. The stakeholders are better informed,” said Resolute Bay Municipality Chief Administration Officer Ian Dudla.

A key factor in building trust and engagement, Diligent Community supported Resolute Bay in meeting a Canadian legal requirement to publish a translated copy of meeting minutes in the local language, Inuktitut, which is made up of syllabic characters.

, Colorado, is another example of how board management software provides connections and engagement opportunities for community members. Town officials wanted to make it easier for their residents to attend meetings so that they could know how the town was managing a large public building project.

With Diligent Community, Carbondale livestreams its meetings directly to the website to appear alongside the agenda. People attending can sign up pre-meeting to speak. A digital timer ensures each speaker gets the allotted three minutes of speaking time. After the meeting, the recording appears alongside the timestamped meeting minutes.

The software also allows publication of documents such as the meeting agenda and materials in formats that can be translated easily to Spanish or other languages, eliminating the language barrier for non-English-speaking community members.

The ways technology provides information and connection

As you can see from the examples of Resolute Bay and Carbondale, board management platforms such as Diligent Community can help local governments provide trusted information, eliminate barriers to engagement and open the doors to active participation from residents. Here are some areas that technology addresses:

Remove barriers and increase accessibility

: Accessibility is fundamental to inclusive governance. Board management software includes features designed to accommodate individuals with disabilities, such as adjustable font sizes, live closed captioning and audio options for seeing impaired individuals. Livestreaming options with closed captioning make it possible for more people to participate in meetings from their homes, 

 of transportation, childcare, or physical limitations. Providing documents in an accessible HTML format allows non-English-speaking residents to use tools such as Google Translate to easily read documents and participate in civic life.

: Governmental websites should be the first place residents turn to when they need information or resources. 

Clear and timely dissemination of information can foster trust and engagement

. Diligent Community allows the public to have easy access to meeting agendas, minutes and policies. They can sign up for meeting notifications and submit a request to speak. They can stay informed about the latest developments and decisions without waiting for information requests to be fulfilled.

: Posting information on a website is not enough to ensure that it will be accessed. Locating specific information within a mountain of documents can be a time-consuming task. Board management software like Diligent Community simplifies this process by offering advanced search functionality. The public can search for keywords or topics of interest, allowing them to quickly find the information they need without sifting through endless pages of documents.

: Livestreamed meetings are essential for community engagement. Livestream Manager for Diligent Community provides reliable and inclusive access for the public using video integrated within public meeting agendas and minutes. Meetings can be livestreamed with closed captions directly on the public website, where viewers can watch the meeting on a split screen alongside the agenda. After the meeting, recordings with timestamped minutes make it easy to navigate through recorded content. This inclusivity encourages a broader range of voices to be heard in the decision-making process, leading to more informed and representative outcomes.

 Board management software like Diligent Community provides a centralized platform for storing, organizing and managing documents such as meeting agendas, minutes, reports and policies. By digitizing these materials and making them easily accessible and searchable online, local governments can ensure that residents can access relevant information when they need it.

: Giving the public greater access to information means that local governments need to be vigilant about data security while making sure they are complying with legal requirements. Board management software like Diligent Community offers robust security features such as user authentication, encryption and access controls to safeguard confidential data.

Board management software enhances community access to information and promotes transparent governance. By centralizing documents, providing updates, encouraging public engagement and prioritizing accessibility, local governments can foster a 

, accountability and civic participation. Trusted information is key to democracy, and embracing technology is necessary for building stronger, more inclusive communities.

Community access to trusted information in the digital age requires digital tools designed for the needs of local governments. Board management technology can help local governments build trust with their community members. Explore how 

 supports board governance and helps build trust and engagement.

Diligent

Blog

Promoting secure information sharing and managing ICT risks: Key requirements for DORA compliance

Transform the way you connect with your community using technology

Solutions

Resources

Company

Your Data Matters

Diligent

Blog

Promoting secure information sharing and managing ICT risks: Key requirements for DORA compliance

Transform the way you connect with your community using technology

SolutionsSolutions

ResourcesResources

CompanyCompany

Your Data Matters

Solutions

Resources

Company