Doradztwo DORA

Is Your Organization DORA-Ready?

Navigating compliance with the Digital Operational Resilience Act.

Digital Operational Resilience Act (DORA)

DORA is an EU regulation on the digital resilience of the financial sector. DORA refers to: Financial sector institutions, in particular banks, payment institutions, insurance companies, reinsurance companies, and crypto-asset service providers.

The regulation came into effect on January 16, 2023. The addressees of DORA have until January 17, 2025, to prepare for the new requirements.

To be DORA-ready, an organization must enhance its operational resilience by implementing robust governance frameworks, conducting thorough risk assessments, and ensuring continuous monitoring of ICT (information and communication technology) systems. It is crucial to develop incident management plans, establish comprehensive cybersecurity policies, and maintain resilient data infrastructure.

Compliance also requires organizations to conduct regular testing of ICT systems for vulnerabilities and

establish protocols for reporting major ICT-related incidents. Additionally, adherence to DORA involves vendor risk management to ensure that third-party service providers meet the same resilience standards.

Key regulations covered by DORA

ICT Risk Management – considering the principle of proportionality and the responsibilities of supervised entities
Management of ICT service providers' risk
Security documentation that should result from identified risks
ICT Incident Management – harmonization and centralization of the management process for serious ICT incidents at both the national and EU level
Verification of the security of systems, processes, and services

Process identification - how to start?

To achieve organizational compliance with DORA regulations, the first step in preparing for the new regulations is:

Processes and resources should be classified according to the requirements of the regulations. In particular, it is necessary to define processes and resources that perform a critical or important function in the enterprise. A critical or important function means a function whose disruption would significantly affect the financial results of the financial entity, the safety, or the continuity of the services it provides. The basic operation of the entity is jeopardized,

thereby potentially suspending its ability to meet the conditions and obligations arising from the permission granted to it or its other obligations under the applicable financial services regulations.

We assist financial entities in fulfilling their DORA obligations

We assist financial entities in fulfilling their DORA obligations. As part of the services provided by experienced experts at Finture, we support clients subject to DORA regulations through the following compliance examination and reporting stages:

1. BIA Analysis

BIA analysis is the first step in preparing for DORA compliance. It helps identify critical and significant resources and processes within the organization. During the analysis, we focus on identifying processes and tasks performed within these processes. Additionally, we identify IT and non-IT resources used by these processes and tasks. We define the connections between processes and determine RTO (Recovery Time Objective) and RPO (Recovery Point Objective), i.e., the time required to restore processes after a failure and the acceptable level of data loss expressed in time.

2. Preparation of procedures

We develop and tailor ICT risk management procedures to meet our clients' needs. Processes are built based on best market practices and frameworks such as ISO 31000 and NIST 800-53. After developing the required procedures, we assist clients in conducting a risk analysis considering all significant factors that might affect the estimated risk level.

3. Risk and safety mitigation plan

We support clients in developing risk mitigation plans. In addition, we develop security procedures, including incident management procedures in accordance with legal requirements. We use process identification patterns and criticality factors we have developed or adapt existing client materials as input.

4. Summary report

The analysis stages conclude with the presentation of results by Finture experts at a summarizing meeting. Our work also produces a comprehensive collective report prepared in collaboration with designated organizational units. The information included may serve as a basis for preparing strategic corporate documents, including periodic reports or reports subject to further legal approvals. The scope and detail of the data included in the summarizing report are always agreed upon with the end recipients. The report will also include recommendations for critical process areas along with scenarios for periodic vulnerability assessments (a process of improving organizational resilience and response to emergency events).

Finture - DORA advisory competencies

We implement IT solutions that assist in managing and verifying processes and systems in terms of their resilience to cyber attacks. We work with many top security solution providers. This gives us knowledge in the range of tools that can be applied to automate and support security within the organization. We help select the solution most suited to the client's needs and support its implementation and maintenance. We have competencies in implementing and maintaining tools for vulnerability management, email protection, securing endpoints and servers, and automating TLPT processes.

Our team

Our team consists of specialists with extensive experience in information security management, risk management, and business continuity management. All these efforts are supported by individuals familiar with the processes and specifics of the financial sector in Poland.

See more of our services

Custom software development

Our company fully understands that the individual needs of our clients require a personalized approach. Our team of technology and insurance industry professionals is ready to create software that perfectly suits the unique requirements and specifics of their business.

Our experience and attention to every detail are the keys to the success of the projects in which we participate.

Staff augmentation

Whether you need a single system-business analyst, a developer, a tester, DevOps, or a complete team to carry out the assigned tasks, at Finture, we are ready to help you select the right person or complete a team according to your requirements.