As entities prepare for the introduction of the Digital Operational Resilience Act, IT security and compliance will be front of mind for many, writes Jackie Hennessy

With the Digital Operational Resilience Act (DORA) on the way, entities must move from preparation to implementation and take steps towards demonstrating how their practices comply.

Financial entities will need to demonstrate appropriate security and resilience of critical information and communication technology (ICT) systems and applications to comply with DORA. The level of compliance efforts will vary depending on the size and complexity of your entity.

A risk-based approach, appropriate security and resilience testing are necessary to address potential vulnerabilities and to prove compliance in meeting the evidence requirements of the European Supervisory Authorities. By focusing on long-term resilience, entities can establish a resilient foundation, which will aid them in their steps towards DORA compliance.

Resilience means learning from the past, to improve the present, and to prepare for the future. 

To make entities ready for DORA, there are five key actions to assist those in the preparation phase. These actions will enable entities to effectively manage their digital operational resilience.

1. Determine strategic priorities

To enhance business practices, organisations must aim to achieve a transformation towards a resilient end-to-end IT and operations environment.

To ensure strong risk management, a focus should be placed on achieving a broad agile transformation that takes into account risks associated with ICT suppliers and continuity measures.

Additionally, it is necessary to aim to increase your organisation's agility in serving digital channels by implementing strong business continuity management (BCM) measures.

2. Implement resilience and incident management measures

To ensure effective implementation of your DORA program, it is crucial to ensure leadership support, as well as translation of strategic and regulatory requirements into operational measures.

It is essential to enable control owners and line management to manage compliance requirements in a risk-based way, including the automation of controls related to digital resilience, to manage the complexity of (compliance) requirements effectively.

Think big and start small – for example, by organising a workshop with relevant middle-management players to align and agree on the implementation strategy of your DORA program.

3. Manage third-party risks

To ensure effective management of ICT risk related to third-party providers, it is essential to conduct complete monitoring of all ICT-related third-party risks throughout all relationship phases.

This involves the classification and analysis of providers and their management bodies, record-keeping of relevant information, managing proportionality, managing compliance and creating a third-party risk assessment process risk strategy.

By undertaking these steps, comprehensive management of ICT risk in relation to third-party providers can be ensured.

4. Test digital operational resilience

To ensure operational resilience, it is crucial to test critical functions more frequently than non-critical, at least once per year. The program for testing digital operational resilience must be based on relevant threat scenarios.

Best practice is to implement an appropriate test set-up for each threat, to test the resilience effectively. Moreover, every three years, entities are required to perform threat-lead penetration testing that simulates a realistic and advanced cyber-attack. This simulation helps organisations to prepare and train for real cyber-attacks.

5. Implement measures for resilience and ICT incidents

To establish strong operational resilience measures and incident management, it is essential to accomplish resilience testing from a wider perspective, which – beyond technical security testing – includes regular crisis simulations.

It is important to improve business continuity plans and ICT crisis scenarios to ensure that uncontrolled disruptions are avoided due to slow and ineffective incident management.

Moreover, accomplishing mature threat intelligence and assessing top continuity risk scenarios is crucial to enhancing resilience and preparedness in critical situations.

By understanding these measures, strong operational resilience can be established, ensuring smooth and uninterrupted operations.

Jackie Hennessy is a Partner at KPMG