The Digital Operational Resilience Act (DORA) came into effect on January 17, with extensive guidelines and a detailed regulatory framework for how all financial services entities doing business in the European Union maintain data resilience against unplanned disruptions.

DORA also recognizes a reality broadly accepted by cybersecurity professionals that it is no longer a question of if a cyberattack occurs, but when. This crucial legislation brings a new level of rigor and accountability to the financial services industry that will continue to evolve to safeguard the stability of the EU and global financial ecosystem.

Many sectors of the financial services industry beyond traditional banks and credit institutions now fall under DORA, including payment providers, investment firms, trading venues, insurance providers, and third-party information and communication technology (ICT) service providers.

Those that are new to this level of regulation may struggle to comply, as indicated by European financial regulators’ DORA “Dry Run Exercise.”¹ They also likely will face additional scrutiny by interconnected customers, partners and other stakeholders as a new operational risk. Non-compliance no longer means just the potential for a very large fine but also reputational damage and liability for a company, its directors, and its partners.

While it remains to be seen how quickly financial regulators act, DORA represents a shift from guidelines for data readiness and cyber resilience to enforcement of it. Given the expansive nature of DORA, which significantly broadens the EU’s financial regulation of IT, regulators, lacking unlimited expertise and resources, may face challenges enforcing all aspects of DORA immediately. As a result, regulators are likely to adopt a targeted approach, focusing on the most critical and visible areas of noncompliance. 

What Financial Organizations Are Prioritizing

A top priority for DORA compliance is the submission of accurate and technically compliant registers of information. Financial regulators have emphasized that registers will be a primary focus of enforcement, and they expect organizations to submit them early in 2025. Submitting an accurate register that details the organization’s most significant IT providers may be more beneficial than submitting incomplete information about all of its IT providers.²

For data protection leaders and CIOs, DORA is a call to action to examine legacy systems and consider whether they are capable of withstanding today’s cyberthreats and can deliver the performance required for efficient, rapid service recovery. 

Beyond identifying and mapping key systems, applications and workloads with respective ICT providers, organizations should carefully consider the core capabilities that protect, defend, and recover these systems. Critical capabilities include:

• Data protection and cyber recovery
  Rapid recovery capabilities are essential under DORA to minimize the operational impact of an attack. The only way to achieve the most stringent, ultra-short RTO required for critical systems is to recover using storage-based immutable snapshots. These snapshots should be securely stored in an isolated (or virtually air-gapped) repository.
  
• Early-warning threat detection
  Identifying and remediating potential cyberthreats earlier is an important aspect of data protection and readiness. The capability to continuously scan data to detect anomalies and identify threats like ransomware and malware in real time and automate remediation is essential for faster containment of an attack. 
  
• Isolated recovery environments (IRE) or cleanrooms for resilience testing
  Establishing a completely self-contained IRE, where data can be restored for forensic and application analysis and validated as clean before returning to production, speeds recovery. IREs also allow organizations to continuously test and improve cyber recovery practices for organizational readiness.
  
• Scalability and performance

Businesses will continue to evolve their services, face new regulatory requirements, and deal with emerging cyberthreats. It’s important to consider a solution’s ability to scale as data requirements change across distributed, hybrid environments while maintaining high-performance speeds for data protection and recovery.

Compliance With Confidence

Organizations that delay establishing robust capabilities to meet DORA and other evolving resilience regulations – such as PSD2, NIS2, APRA CPS 230, and the European Cyber Resilience Act coming into effect in 2026 – may find themselves with mounting challenges to overcome. They also may find themselves at competitive disadvantage to firms that can demonstrate their ability to remain resilient in the face of disruptions in the global financial ecosystem.

Working with partners that understand the regulation’s resilience requirements and deploying robust solutions can help enable organizations to be compliant and better prepared to meet new regulatory challenges and defend their data environment against emerging threats.

Pure Storage and Commvault have come together to build a joint solution, modular in design, that helps financial institutions enhance their cyber resilience practices and address key pillars of DORA for incident response and resilience testing. The solution is built by integrating the leading cyber resilience capabilities of Commvault® Cloud with the highly secure, high-performance Pure Storage platform.  Learn more about the solution and our commitment to cyber resilience here.

Are You Cyber-ready?

Readiness reflects mature cyber resilience, where technology, people, and processes work seamlessly to enable continuous business in the face of any cyber challenge. Evaluate your organization’s cyber resilience with Commvault’s Cyber Maturity Assessment.  

¹ Key findings from the 2024 ESAs Dry Run exercise, European Banking Authority, Dec.17, 2024.

² Countdown to DORA – Four Takeaway Points from Regulators’ December Statements, Skadden, Arps, Slate, Meagher & Flom, LLP, Jan. 3, 2025

Whether it’s a sudden market shift, a cybersecurity breach, or a regulatory change, the unexpected can strike at any moment. Being prepared is key to navigating these challenges successfully. This is where risk management and the Digital Operational Resilience Act (DORA) – a regulatory framework that takes effect in January to help protect financial institutions from disruptions like cyberattacks – come into play.

DORA applies to a wide range of financial entities in the European Union, including credit institutions, investment firms, payment institutions, and electronic money institutions. It also covers critical third-party service providers. Let’s explore how DORA’s risk management requirements can help you stay ahead of the game and keep your organization resilient in the face of uncertainty.

What Is Risk Management?

Risk management is the process of identifying, assessing, and prioritizing risks followed by the application of resources to minimize, monitor, and control the probability or impact of unfortunate events. Effective risk management isn’t just about avoiding disasters; it’s about creating a robust framework that supports your strategic goals and enhances your decision-making.

Risk management helps protect your organization’s assets, including financial resources, physical property, and reputation. By identifying potential threats, you can take proactive steps to mitigate them.

Investors, customers, and employees are more likely to trust and support an organization that demonstrates a strong commitment to risk management. Understanding risks helps you make better strategic decisions. It allows you to allocate resources more effectively and focus on areas that truly matter..

How DORA Aligns with Risk Management

DORA and risk management are closely aligned, as both focus on preparing for and mitigating potential disruptions. Here’s how DORA’s components fit into a broader risk management strategy:

1. Risk management framework: DORA requires financial entities to establish a comprehensive risk management framework. This framework should include policies, procedures, and controls to identify, assess, and manage risks. It’s like having a detailed map of potential hazards, allowing you to navigate them more effectively.
2. Incident reporting: Timely and accurate incident reporting is crucial for maintaining operational resilience. By reporting incidents, you can quickly address issues and learn from them, reducing the likelihood of similar events in the future.
3. Testing and exercises: Regular testing and exercises are essential for verifying that your systems and processes can handle disruptions. This might include simulated cyberattacks, system outages, or other scenarios. It’s like practicing fire drills to so that everyone knows what to do in an emergency.
4. Third-Party Dependencies: Many financial entities rely on third-party service providers for various operations. DORA emphasizes the importance of managing these dependencies so that they do not pose a risk to your operational resilience. This involves conducting due diligence, establishing service-level agreements (SLAs), and monitoring performance.

Best Practices for Risk Management and DORA Compliance

1. Stay Informed: Keep up to date with the latest regulatory changes and industry best practices. This will help you stay ahead of the curve and confirm your risk management framework remains effective.
2. Collaborate: Work closely with other departments and stakeholders to create and maintain a holistic approach to risk management. Collaboration can help you identify and address risks that might otherwise go unnoticed.
3. Continuous improvement: Risk management is an ongoing process. Regularly review and update your risk management approach so that it stays relevant to the current state of your organization.
4. Technology investment: Invest in the right technology to support your risk management efforts. This might include risk management software, cybersecurity tools, and data analytics platforms.
5. Cultural shift: Foster a culture of operational resilience within your organization. Encourage employees to report potential risks and participate in risk management activities.

The Future of Risk Management and DORA

As technology continues to evolve, so too will the risks and challenges faced by financial entities. DORA is a step in the right direction, but it’s just the beginning. Here are some trends to watch:

Artificial Intelligence (AI) can help automate risk management processes, making them more efficient and effective. For example, AI can be used to detect and respond to cyber threats in real-time.

Cloud security will become increasingly important as more organizations move to the cloud. DORA’s requirements will likely evolve to address this growing concern.

Regulatory changes are a constant, as governing bodies update their guidelines to address new risks. Stay informed and be prepared to adapt as needed.

Global standards for operational resilience will likely emerge as more countries adopt similar regulatory frameworks. This will make it easier for organizations to operate across different jurisdictions.

Protect Your Organization with a Proactive Approach

Risk management and DORA are powerful tools for preparing for the unexpected. By establishing a robust risk management framework and maintaining DORA compliance, you can help protect your organization’s assets, maintain stakeholder confidence, and achieve your strategic goals. Remember, the key to success is a proactive and continuous approach. Stay informed, collaborate with stakeholders, and invest in the right technology to build a resilient and thriving organization.

With the right tools and strategies, you can turn potential threats into opportunities for growth and improvement. So, take the first step today and start preparing for the unexpected. Your organization’s future depends on it.

Learn more about how you can prepare for the Digital Operational Resilience Act in our Exploring DORA blog series:

• An Overview of the Digital Operational Resilience Act
• 9 Steps on the Path to Compliance
• Understanding the Global Regulatory Landscape
• Building Resilience: Cyber Recovery Strategies Under DORA
• The Role of Data Management in Regulatory Compliance
• Risk Management and DORA: Preparing for the Unexpected