The deadline for implementing the DORA Regulation (Digital Operational Resilience Act) expires on 17.01.2025. Among other things, all permitted capital management companies and investment institutions are obliged to implement them. The main objective is to strengthen the digital resilience and cybersecurity of financial market participants and to ensure that companies are able to respond quickly and effectively to cyberattacks and IT disruptions.
However, this means that obliged entities will have to adapt to numerous new and complex requirements that go beyond the previous KAIT and BAIT standards. These include:
- Governance of ICT third-party service providers: Agreement on stricter contractual requirements and conduct a regular risk assessment of key and critical ICT third-party service providers. Documentation and reporting to supervision upon request to ensure that ICT third-party service providers also comply with cybersecurity standards.
- Reporting ICT-related incidents: Establishment of technical measures to detect and defend against cyber attacks. This includes technical monitoring, regular review and updating of security systems, the classification of incidents and the reporting of serious incidents to the relevant authorities.
- ICT risk management framework: Implementation of ICT risk management, which includes the systematic identification, assessment, monitoring and management of risks arising from the use of information and communication technology (ICT) in order to strengthen operational resilience and effectively counter cyber threats.
The DORA Regulation is an important step towards a safer and more resilient digital future for the financial sector. However, it requires great efforts to comply with the many new regulations and ensure digital security, as in many cases internal structures, processes and IT systems have to be fundamentally revised to meet the new requirements.
Those who do not take these requirements seriously risk not only fines, but also massive reputational and financial consequences in the event of a cyberattack.
