Legal basis
It removes obstacles to, and improves the establishment and functioning of the internal market for financial services by harmonising the rules applicable in the area of ICT risk management, reporting, security control testing and ICT third-party risk.
Subsidiarity
The proposal harmonises the digital operational component of a deeply integrated and interconnected sector that already benefits from a single set of rules and supervision in most other key areas. For matters such as ICT-related incident reporting, only Union harmonised rules could reduce the level of administrative burdens and financial costs associated with the reporting of the same ICT-related incident to different Union and national authorities.
Proportionality
Proportionality is designed in terms of scope and intensity through the use of qualitative and quantitative assessment criteria. While the new rules cover all financial entities, they are at the same time tailored to risks and needs of their specific characteristics in terms of their size and business profiles. Proportionality is also embedded in the rules on ICT and cyber-risk management, digital resilience testing, reporting of major ICT-related incidents and oversight of critical ICT and cyber third-party service providers.
Choice of instrument
The measures needed to govern ICT and cyber risk management, ICT and cyber-related incident reporting, testing and oversight of critical ICT and cyber third-party service providers must be contained in a Regulation in order to ensure that the detailed requirements be effectively and directly applicable in a uniform manner, without prejudice to proportionality and specific rules foreseen by this Regulation.
Three DORA requirements businesses should aim to achieve
1. ICT-related incident reporting
One of the main requirements for financial entities is to establish and implement a management process to monitor and log ICT and cyber-related incidents, followed by an obligation to classify them based on criteria detailed in the regulation and further developed by the ESAs through to specify materiality thresholds. Only ICT-related incidents that are deemed major must be reported to the competent authorities.
2. Cyber operational resilience testing
The capabilities and functions included in the ICT risk management framework need to be periodically tested for preparedness and identification of weaknesses, deficiencies or gaps, as well as the prompt implementation of corrective measures.This regulation allows for a proportionate application of digital operational resilience testing requirements depending on the size, business and risk profiles of financial entities.
3. ICT and cyber third-party risk
The regulation is designed to ensure a sound monitoring of ICT and cyber third-party risk, financial entities shall be required to observe several key elements in their relationship with ICT and cyber third-party providers, remaining fully responsible for complying with and discharge of all obligations. To this end, contracts that govern this relationship will be required to include at least a complete description of services, indication of locations where data are to be processed, full service level descriptions accompanied by quantitative and qualitative performance targets, relevant provisions on accessibility, availability, integrity, security and protection of personal data, inspection and audit by the financial entity or an appointed third-party, clear termination rights and dedicated exit strategies. As such DORA should be taken into consideration in close coordination with NIS Directive version 2, CBI Operational Resilience Guidelines and the EU Critical Infrastructure Directive.
DORA is part of the Digital finance package, a package of measures to further enable and support the potential of digital finance in terms of innovation and competition while mitigating the risks arising from it. It is in line with the Commission's priorities to make Europe fit for the digital age and to build a future-ready economy that works for the people. PwC can help you understand the requirements that affect your organisation and help you to prepare for DORA.
