DORA Compliance: Prepare Your Business with These 5 Key Pillars

DORA is the EU regulation on digital operational resilience for the financial sector. It requires financial entities to show that their digital operations can withstand attacks, failures and supplier outages.

This guide sums up what DORA asks for, what your organisation has to put in place and where to start. It is written for the risk, compliance and security teams who have to put it into practice.

When it applies

DORA has been mandatory for financial entities in the European Union since that date. It builds on European and international good practice in cyber and operational resilience.

Who it affects

• Credit institutions
• Payment institutions
• Financial system providers
• Investment firms
• Credit rating agencies
• Insurers and reinsurers
• Fintechs
• Crypto-asset service providers
• Crowdfunding platforms

What's in the guide

1. What DORA isThe aim of the regulation, since when it applies and which organisations are in scope.
2. The 5 pillarsICT risk management, incident management, resilience testing, ICT third-party risk and threat intelligence.
3. Seven-point checklistEach requirement with the actions to have in place, from the risk management framework to sharing information on cyberattacks.
4. How GlobalSuite® helpsThe regulation as a requirements catalogue, incident reporting deadlines, the business impact analysis and a register of ICT providers.

Standards that help you comply

The guide maps DORA to ISO 27001, ISO 27005, ISO 31000, ISO 22301, ISO 22313 and ISO 22317, the GDPR, the Spanish LOPDGDD and the NIS2 Directive. If you already work with any of them, you are a good part of the way there.