#

Pillar

Description

1.

ICT risk management and governance

Financial entities must have a comprehensive, well-documented ICT risk management framework, which enables them to address ICT risk effectively and ensure a high level of digital operational resilience.  

The framework must include appropriate strategies, policies, procedures and tools (including technical measures) to protect information and ICT assets, and ensure resilience, continuity and availability of ICT systems. Entities must also map and classify their ICT systems.  

The framework must also include a digital operational resilience strategy, setting out how the framework should be implemented.  

Financial entities must also have a governance and control framework in place to ensure effective and prudent management of ICT risk, and DORA places specific requirements and responsibilities on the financial entity's management body (the management body bears ultimate responsibility for managing the financial entity’s ICT risk).

2.

ICT-related incident management and notification

Financial entities must establish and implement a process to detect, manage, classify and notify ICT-related incidents. An ICT-related incident is an unplanned event that compromises the security of an ICT system and has an adverse impact on the data or the services provided by the financial entity.  

Major ICT-related incidents, which have a high adverse impact on the ICT systems that support critical and important functions of the financial entity, must be reported to the relevant regulator. DORA, together with technical standards to be issued under DORA, set out greater detail on the timing and format of the notification.  

Where a major ICT-related incident impacts the financial interests of the financial entity's clients, the entity must notify their clients of the incident and the measures they have taken to mitigate the effects of the incident. This must be done without undue delay.

4.

ICT third-party risk management

Financial entities must establish a digital operational resilience testing programme, to regularly assess their preparedness for handling ICT-related incidents, and to identify weaknesses, gaps and deficiencies in their digital operational resilience.  

The testing programme should apply a risk-based approach, taking into account the specific risks to the financial entity.  

DORA specifies various possible tests, such as vulnerability scans, network security assessments, source code reviews, and scenario-based tests.  

DORA also requires certain specified financial entities to conduct advanced testing by means of threat-led penetration testing, which simulates realistic cyberattacks on the entity's ICT systems, at least every three years.

3.

Digital operational resilience testing

Financial entities must manage the ICT risks arising from their outsourcing or use of ICT third-party service providers as an integral part of their ICT risk management framework.  

As part of this, financial entities must adopt and regularly review a strategy on ICT third-party risk and maintain a register of information in relation to the contractual arrangements with the ICT third-party service providers, distinguishing between services that relate to critical and important functions and those that do not.  

Before entering into a contract with an ICT third-party service provider, the financial entity must take certain pre-contractual steps prescribed by DORA, such as appropriate due diligence. DORA also prescribes the minimum provisions that must be included in the contract with the ICT third-party service provider, and mandates that the full contract should be documented in one written document.

5.

Cyber-threat intelligence sharing

DORA also sets out a framework through which financial entities are encouraged (but not obliged) to share cyber-threat intelligence and information.