DORA alert: financial companies obliged to comply with DORA with effect from 17 January

DORA alert! The long-awaited moment has arrived: with effect from 17 January, financial companies are obliged to comply with the Digital Operational Resilience Act (DORA).

This EU Regulation aims to ensure uniform management of cyber and ICT risks by financial companies falling within DORA's scope. Key obligations include having an ICT risk management framework, mapping ICT processes and systems, and identifying specific dependencies between business units and ICT services and systems. In addition, quality criteria must be observed when selecting ICT service providers, and minimum requirements apply to ICT contracts. Detailed information about these ICT contracts must be recorded in a register of information, which will have to be shared with the supervisory authorities upon request. Financial institutions must also report ICT incidents to the supervisory authorities in a standardised way and ensure that staff follow adequate training on how to properly handle ICT risks and comply with DORA. Management boards must also have sufficient expertise and be actively involved in DORA implementation and compliance. For more information, see our more detailed DORA publications: here and here. 

Still working on implementing DORA requirements? Our experts will be pleased to help you achieve compliance as soon as possible. For example, we can assist you by: 

• Advising on and conducting DORA impact assessments to acquire a clear overview of the obligations that your company must meet. We will also be pleased to assist with their implementation. 
• Negotiating and adjusting contracts with ICT service providers.
• Setting up the DORA register of information.
• Reviewing and drawing up policies.