How does the new EU regulation DORA (Digital Operational Resilience Act) affect the financial sector's IT infrastructure?

At the beginning of next year a new regulation called DORA comes into force in the European Union, intended to reduce the digital vulnerability of the financial sector. The aim is to improve companies' ability to withstand, adapt to and quickly recover from various ICT disruptions, such as technical failures and cyberattacks. That comes with a series of requirements affecting banks, crypto-asset service providers and insurers alike: in total, thousands of organisations operating in Europe. What will DORA regulate, what should be started before the year changes, and how does it affect server rooms and data centers?

What is DORA?

"Where until now ICT risks in the financial sector have been regulated differently in different European Union member states, the core requirements are now being harmonised," the Financial Supervision Authority comments in a written reply. DORA, the Digital Operational Resilience Act, comes into force on 17 January 2025. The regulation deals with the digital operational resilience of the financial sector, that is, companies' ability to ensure continuity and security in any crisis situation. According to the Financial Supervision Authority it applies to a large part of the financial sector. The changes affect, among others, banks, payment institutions, e-money institutions, investment firms, crypto-asset service providers and trading venues, insurers and insurance intermediaries, fund managers and crowdfunding service providers.

DORA was created out of the need to reduce the financial sector's vulnerability in the digital world. Technology develops quickly and the financial sector's dependence on ICT systems is growing. "The aim of the regulation is to reduce the risk in the financial sector of business processes and important functions being interrupted, with consequences for both the company's and its customers' information and financial assets, which may be caused by technical failures, operational errors and cyberattacks alike. Among other things the regulation helps increase the protection of financial services customers and investors," the Financial Supervision Authority comments.

What will DORA regulate?

As already said, DORA focuses strongly on the security and reliability of ICT systems and services. The financial sector is becoming ever more technology-based and depends to a large extent on information technology solutions. DORA requires financial institutions to adopt thorough measures for managing ICT risks and ensuring their digital resilience. That concerns not only technological solutions and (digital) infrastructure but also streamlining organisational processes and training staff.

The regulation sets out requirements on ICT risk management, the classification of ICT incidents and notification of the supervisor, digital operational resilience testing, management of ICT third-party risk, information sharing between financial institutions and so on.

So what has to be taken into account from now on?

• Financial institutions must regularly test the security and also the physical reliability of their IT systems, including carrying out attack simulations, to ensure resilience and identify weaknesses before they turn into real problems.
• Companies must establish procedures for quickly classifying and reporting ICT incidents. For example, guidelines must be drawn up on how to deal with a data leak, and it must be ensured that incidents are reported to the relevant supervisory authorities in good time.
• Financial institutions must regularly assess and monitor the reliability and security of third-party ICT service providers. That means all contracts must contain clear, verifiable requirements on security and service continuity, and they must be reviewed regularly.
• Companies must develop and implement digital operational resilience plans that include crisis management strategies and recovery procedures. Those plans must also be tested and kept up to date to ensure readiness for possible emergencies.
• ICT risk assessment must be integrated into the company's daily operations. That means continuous monitoring and regular audits. Companies have to create mechanisms for identifying, assessing and effectively managing risks.

It should be mentioned that the principle of proportionality applies in DORA. That means relief applies to micro, small and medium-sized enterprises and to a few other companies exempted under the directives. Above all it is large companies with international reach that have to review their IT footprint and its security and reliability.

Financial institutions must review their service providers too

"The important thing to understand about DORA is that it applies not only to financial institutions but also to the ICT service providers that serve the financial sector. A considerably more demanding view of IT infrastructure sets higher quality expectations for providers. That makes auditing, and passing audits, simpler for financial institutions," explains Martin Rungi, who deals daily with the needs of this sector at the Baltics' largest data center.

Among other things, the physical security of equipment rooms comes into focus. "Broad-based cybersecurity is only useful if there are no shortcomings in physical security. In the more curious examples, outsiders have had free access to ICT equipment. From there, with bad intentions, it is easy to simply cut the power and cause an extensive outage. So the data center service provider must be able to convincingly explain and prove how the customer's equipment is protected," Rungi explains.

Second, reliability. "In working through risk scenarios, an important component is how the fault tolerance of the IT infrastructure is ensured. Put simply, if there is no power in business-critical equipment, there is no bank these days either. So the financial institution has to require an audited confirmation from the data center that reliability is genuinely ensured, or else carry out broad-based audits of the equipment rooms itself, which is an extremely time-consuming and knowledge-based activity. That already presupposes recruiting a specialist with specific competence," adds the Greenergy Data Centers segment manager.

Third, the certification of data centers. "The right certificate can significantly simplify demonstrating compliance with DORA or other regulations, because the auditor does not have to go through everything related to the infrastructure piece by piece. The verification has already been done in obtaining the certificate. That reduces the burden on the customer considerably," Rungi adds. He says financial institutions could agree very clearly with their ICT infrastructure provider how the latter will help the company meet DORA requirements and pass audits more smoothly.

What else to know? For companies in the financial sector it is important to familiarise themselves before the new year with the DORA requirements, compliance with which the Financial Supervision Authority will start to monitor, as well as with DORA's technical regulations.

In summary, financial institutions undoubtedly face a lot of work to adapt their ICT systems and processes to the new requirements, but ultimately it contributes to creating a safer and more stable financial sector. That benefits financial institutions themselves too.

Andrus Tamm, head of product development and technology at SEB Eesti, comments

What opportunities does DORA offer for making IT systems more secure and reliable?

The DORA requirements were drawn up on the basis of long experience. People working in cybersecurity, business continuity and IT operations in this field have been talking constantly about similar requirements or corresponding action plans. DORA now gives them clearer requirements and describes them more specifically. It gives those responsible for the system as a whole (the regulators) the opportunity to do data analysis and, in assessing the state of cyber resilience, draw more systematic conclusions and issue more systematic guidance. For example, until now we have had no uniform criteria for assessing incidents; mostly everyone assessed them based on their own needs and experience.

DORA provides a good basis and framework for creating protective mechanisms in a company. It is certainly not free, but we do not forget to insure our car, and even though it is compulsory, we value that requirement highly when we get into an accident and receive help covering the damage. Similarly, DORA is an obligation that gives the opportunity to create a resiliently functioning environment. It is a need that has imperceptibly grown into a very large part of our lives, our digital lives, that is, the digital services we use daily and must also protect diligently. A digital service is not only an asset; it is above all a responsibility, a responsibility for its functioning.

DORA also very appropriately addresses the bigger pain points of cybersecurity, such as diligent and thorough testing for cyber vulnerabilities and third-party due diligence and its documentation and control. Until now companies have been rather modest in checking the diligence of their service providers, and when the service provider is very large, that disproportion in size is often also the reason the control is insufficient or absent altogether. With DORA our central European regulators have enough power to balance that situation.

To what extent does thinking IT systems through well, and using a data center built and certified to high standards, make meeting DORA requirements easier?

SEB highly values its partners' diligence and readiness to share information in fulfilling their obligations. In building large systems we certainly have to specialise and do what is within our capability. SEB does not build its own data centers; we buy that as a service from companies specialised in it. We do the same with many services or products we can find on the market. As with buying in any service, in this area too we need critical knowledge on our own side to assess whether our partners act in a way that suits us. Part of that way is certainly compliance with laws and regulations.

We highly value our partners' wish to build their services and systems according to good practice, and activity that demonstrates this in the form of proof or a certificate of using the standard in force in this field. I am very pleased that Greenergy Data Centers has done very good work in this area and holds certificates that, among other things, also help in assessing the service to understand more clearly the due diligence measures in use.