What is DORA?
DORA, which stands for the Digital Operational Resilience Act, is a new regulation in the European Union (EU) that focuses on the financial sector. Its main goal is to make sure that financial companies can handle and quickly recover from major disruptions, especially those related to information and communication technologies (ICT), like cyberattacks or system failures. Think of it as a rulebook for how banks and other financial institutions should manage their digital risks to prevent big problems.
Examples
Imagine a major bank’s online banking system goes down because of a server crash. Before DORA, the bank might not have had a clear plan to get the system back up and running quickly. Under DORA, the bank is required to have a detailed plan for this kind of event, including how it will notify customers and regulators, and how it will restore services within a specific time frame.
Another example is a payment company that uses a third-party cloud service. If that service provider has a data breach, DORA requires the payment company to have a contract in place that outlines exactly what the cloud provider’s responsibilities are for security and what happens if something goes wrong.
Context
DORA was created because the financial world is so reliant on digital technology. A single cyberattack or tech failure could have a ripple effect, causing widespread chaos and financial losses. DORA aims to create a strong, consistent approach to digital resilience across all EU financial companies. It replaces and builds upon older, less comprehensive rules. The act makes sure that companies, including those that provide digital services to the financial sector, like cloud providers, are all held to the same high standards.
Relevant ISO 27001 Controls
The following controls from the ISO/IEC 27001:2022 standard are relevant to DORA because they help organisations manage information security, a key part of digital resilience:
ISO 27001:2022 Annex A 5.1: Policies for Information Security
ISO 27001:2022 Annex A 5.7 Threat Intelligence
ISO 27001:2022 Annex A 8.28 Secure Coding
ISO 27001:2022 Annex A 5.23 Information Security For Use Of Cloud Services
ISO 27001:2022 Annex A 8.15 Logging
ISO 27001:2022 Annex A 8.8 Management of Technical Vulnerabilities
ISO 27001:2022 Annex A 5.30 ICT Readiness For Business Continuity
