DORA (Digital Operational Resilience Act) applies to a broad range of financial companies in Sweden and other EU countries.
Here is an overview of which companies are covered by DORA:
• Banks
All types of banks, including commercial banks and savings banks.
• Insurance companies
Companies offering various types of insurance.
• Investment firms
Companies managing investments, including fund management companies and asset management firms.
• Payment institutions
Companies providing payment services.
• E-money institutions
Companies issuing electronic money.
• Credit institutions
Companies offering credits and loans.
• Securities firms
Companies trading in securities.
• Pension funds
Managers of pension funds.
• Critical ICT service providers
Providers of information and communication technology (ICT) critical for financial companies' operations.
What is DORA?
In short: A new EU framework for managing digital risks in the financial sector.
Aims to strengthen the digital operational resilience of financial companies against cyber threats and IT incidents.
Applies to a broad range of financial companies, including banks, insurance companies, investment firms, and critical ICT service providers.
Requires ICT risk management, incident reporting, resilience testing, and third-party risk management.
Entered into force on January 16, 2023, but companies have until January 17, 2025, to implement the requirements.
Creates a unified regulatory framework for the entire EU, harmonizing previous practices regarding cybersecurity in the financial sector.
DORA thus represents a significant change in how financial companies must manage their digital risks and security, aiming to create a more resilient financial sector in the EU.
What should financial companies consider regarding the web?
For a website covered by DORA to become compliant, it needs to implement several concrete measures. Here are some of the most important things to focus on:
1. Robust security architecture
- Implement strong encryption for all data traffic (HTTPS)
- Use secure authentication methods, such as multi-factor authentication
- Ensure all sensitive data is stored encrypted
2. Regular security testing
- Conduct penetration tests at least annually
- Perform continuous vulnerability assessments
- Implement automated security scanning of the code
3. Incident management and reporting
- Establish a clear process for detecting and managing security incidents
- Have systems in place to quickly report serious incidents to relevant authorities
4. Updated risk management
- Conduct regular risk assessments of the website and its components
- Document and continuously update risk management processes
5. Third-party management
- Review and ensure all third-party providers (e.g., hosting solutions, API providers) meet DORA's requirements
- Include DORA-specific clauses in agreements with providers
6. Logging and monitoring
- Implement comprehensive logging of all activity on the website
- Set up systems for real-time monitoring of security-related events
7. Recovery planning
- Develop and regularly test a business continuity and disaster recovery plan
- Ensure there are redundancy and backup solutions for critical systems
8. Training and awareness
- Conduct regular security training for all personnel managing the website
- Create clear guidelines and policies for the safe use and maintenance of the website
9. Documentation and traceability
- Establish detailed documentation of the website's architecture, security measures, and processes
- Ensure traceability in all changes and updates to the website
10. Information sharing
- Establish channels to share information about cyber threats and vulnerabilities with other actors in the sector