DORA is a test of how you operate, not a mapping exercise.

WHAT IT DEMANDS

Five areas, one regulation.

1. An ICT risk-management framework owned by the management body. Resilience is the board's responsibility, not something delegated wholesale to IT.
2. ICT incident management, classification and major-incident reporting. A defined process to detect, classify and report the incidents that matter.
3. Digital operational resilience testing, including threat-led penetration testing (TLPT) for significant entities. Regular testing, with TLPT expected of the entities that carry the most weight.
4. ICT third-party risk management, including a maintained register of information. A single register covering all ICT third-party arrangements, kept current.
5. Information and intelligence sharing. Arrangements to exchange cyber threat information across the sector.

WHERE FIRMS TRIP

• Treating DORA as a one-off gap-mapping exercise, then moving on.
• A register of information that is incomplete, or already stale.
• Concentration risk sitting in a handful of cloud and ICT providers.
• Incident classification that exists on paper but isn't operational.
• Testing that never gets near threat-led.

HOW WE HELP

RELATED