Who is Dora

The Digital Operational Resilience Act (DORA) is a comprehensive EU regulation that aims to strengthen the digital resilience of financial firms. It is designed to ensure that firms in the financial sector are robust enough to deal with cyberattacks, IT outages and other digital threats.

Under the Trump administration, the phrase “America First” became a central slogan. In the context of trade policy, it meant protecting domestic industries and reducing the trade deficit. Accordingly, President Trump announced early on his intention to impose punitive tariffs on a range of imported goods. Particularly high-profile were—and remain—the tariffs on steel and aluminum from various countries. China repeatedly came under the U.S. spotlight because, according to Trump, there were massive trade imbalances. These tariffs quickly led to countermeasures and retaliatory tariffs. Countries like China and EU member states struck back by introducing their own tariffs on U.S. products, such as agricultural goods and certain consumer products.

What does DORA include?

DORA sets out clear requirements for the management of information and communication technologies (ICT), including the following key areas:

ICT risk management: Financial firms must implement robust processes to identify, assess and manage ICT risks. This includes both preventive and reactive measures to effectively combat potential threats.
Incident reporting: Firms are required to report serious ICT incidents to the relevant authorities. This ensures a rapid response to critical disruptions and strengthens the overall crisis resilience of the financial sector.
Continuity plans: DORA requires companies to develop and regularly test contingency and recovery plans to ensure they remain functional even in times of crisis.
Monitoring of third-party service providers: Since many companies rely on external service providers, DORA ensures that they are also audited and monitored for digital resilience to minimize potential vulnerabilities.
Audits and controls: Financial firms must conduct regular audits and controls of their ICT systems to identify and remediate vulnerabilities.

Preparing for DORA

To prepare for DORA, companies should take the following steps:

Assess current ICT risks: Start with a thorough assessment of the current ICT infrastructure to identify and remediate vulnerabilities.
Create a contingency plan: Develop detailed contingency and recovery plans and test them regularly.
Training and awareness: Train your employees regularly on how to manage cyber risks and comply with DORA regulations.
Collaboration with third parties: Make sure that your third parties also meet the requirements of DORA and are regularly audited.
Regular audits: Conduct regular audits of your ICT systems to ensure and continuously improve compliance with DORA guidelines.

DORA represents a significant tightening of regulatory requirements in the financial sector, but in the long term it will increase the stability and security of the entire financial system. Companies that proactively prepare for these regulations can not only ensure compliance, but also significantly strengthen their digital resilience.