DORA has a comprehensive scope and regulates various aspects of digital security and resilience. It regulates the following:

ICT Risk Management Capability

The regulation introduces stricter requirements regarding ICT risk management capability. However, exceptions exist where micro-enterprises or other financial entities, depending on their size and risk profile, can have a simplified ICT risk management framework.

Incident Reporting

To enable financial entities to maintain full control over ICT risk, they must, in addition to having overall capabilities that enable robust and effective ICT risk management, have specific mechanisms and guidelines to handle all ICT-related incidents and report major ICT-related incidents.

Testing

DORA includes provisions for conducting appropriate tests, such as vulnerability assessments and scans, open-source analyses, network security assessments, gap analyses, physical security reviews, questionnaires and scanning software solutions, source code reviews where possible, scenario-based testing, compatibility testing, performance testing, end-to-end testing, and penetration testing.

Management of ICT Third-Party Risks

DORA applies to all critical third-party providers of ICT services, including cloud service providers offering ICT services to financial entities. Since third-party ICT service providers often deliver standardized services to various types of customers, such contractual arrangements may not always meet the individual or specific needs of financial sector entities.

Therefore, it is necessary to establish certain key principles to guide financial entities’ management of ICT third-party risks, which are especially important when financial entities use third-party ICT service providers to support critical or important functions. These principles should be accompanied by a set of fundamental contractual rights regarding several aspects of the performance and termination of contractual arrangements to provide certain minimum safeguards to enhance financial entities’ ability to effectively monitor all ICT risks arising at the third-party service provider level.

Collaboration and Information Sharing Among Actors

As ICT risks become increasingly complex and sophisticated, effective measures to detect and prevent ICT risk will largely depend on the regular exchange of threat and vulnerability intelligence between financial entities. Information sharing contributes to increased awareness of cyber threats.

Under certain circumstances, financial entities may exchange information and intelligence on cyber threats, including indicators of compromised security, tactics, techniques and procedures, cybersecurity alerts, and configuration tools.