DORA - How to Comply with Regulatory Requirements and Effectively Establish Digital Operational Resilience in Your Company

European Union Regulation No. 2022/2554 on digital operational resilience for the financial sector, known as DORA (Digital Operational Resilience Act), is a key regulation aimed at ensuring that financial institutions can withstand cyber threats and maintain the continuity of their services even in the event of severe operational disruptions. The regulation comes into effect on January 17, 2025, making it crucial to start implementing the necessary measures now.

In our law firm, we have been addressing this issue intensively and for a long time. Therefore, we have prepared clear and comprehensive documentation for you that complies with all DORA requirements and reflects the related interpretative materials and checklists provided by the Czech National Bank.

Key Areas of Solution According to DORA

1. Functions, Processes, and Overall Strategy for Digital Operational Resilience

The initial step in meeting the requirements of the DORA regulation is the proper identification of all critical and important business functions and processes within the company, along with creating documentation of the assets that support these functions and processes.

Following this step, a risk catalog is prepared, outlining the threats faced by the company, and a strategy is established. This strategy encompasses the company’s overall approach to identified risks and ensures operational resilience. The strategy defines long-term goals, rules, and responsibilities for maintaining operational resilience.

2. Framework for ICT Risk Management

To ensure the security of information and communication technologies (ICT), it is necessary to implement a robust risk management framework that includes:

• Summary of the identification and assessment of assets and risks conducted in step one:

  • List of Business Functions
  • Description of Methods for Identifying and Managing Assets in the ICT Domain
  • Catalog of Assets (Information and ICT) and Their Vulnerabilities
  • Catalog of Identified Threats and Risks
  • Impact Analysis

• Description of implemented security measures to ensure the availability, confidentiality, and integrity of data:

  • Communication Policy and Crisis Communication
  • Policy and Procedures for Physical and Logical Security
  • Policy and Protocols for Strong Authentication Mechanisms
  • Procedures for Ensuring Data and System Security
  • Log Management Procedures
  • Environmental Security Policy
  • Identity Management Policy and Procedures
  • Access Management Policy
  • Information Security Policy
  • Policy, Procedures, and Protocols for Protecting Information During Transmission
  • Description of ICT Infrastructure Management
  • Capacity and Performance Management Procedures
  • Vulnerability Management Procedures

• Risk Management (Business Continuity) and Development Plans in the Company:

  • Procedures for Business Continuity – ICT Response and Recovery
  • Procedures for Activity Logging Before and During Outages
  • Backup Policy and Procedures
  • ICT Recovery Procedures and Methods
  • ICT Change Management, Patching, and Update Policy and Procedures
  • Policy for Procurement, Development, and Maintenance of ICT Systems
  • Policy for ICT Project Management
  • Awareness and Training Programs in ICT

3. ICT Incident Management and Reporting

As part of DORA requirements, the implementation of processes for incident management includes:

• Incident Classification:

  • Description of the method for classifying incidents (determining the severity of incidents based on their impact on operations).

• Incident Management and Reporting:

  • ICT Incident Management Policies and Procedures.
  • Description of Incident Logging.
  • Procedures for Monitoring, Resolving, and Following Up on ICT Incidents.
  • Procedures for Reporting Incidents to Regulatory Authorities.

• Communication Plans:

  • Procedures for Communicating with Clients and Stakeholders.

4. Testing Digital Operational Resilience

Regular resilience testing is crucial to verify whether a company can respond to cyber threats. Testing includes:

• Testing Plan, which defines the frequency and scope of individual tests (including potential penetration and stress tests):

  • Program and Procedures for Testing Digital Operational Resilience

5. Third-Party Relationship Management

Companies must effectively manage risks associated with ICT service providers. This includes:

• Vendor Register:

  • Documentation of all external vendors and their roles.
  • Security Assessment of ICT Vendors.

• Risk Assessment and Management:

  • ICT Third-Party Risk Management Policy.
  • Strategies and Plans for Contract Termination.
  • Transition Plans to Alternative Providers.
  • Multi-Vendor ICT Strategy.

• Contractual Agreements:

  • Ensuring contracts with vendors include requirements for security and service continuity.

How can we assist you?

Our office will provide you with comprehensive support in implementing the DORA regulation. We offer:

• A ready-made set of documents containing all the aforementioned strategies, policies, guidelines, and plans necessary to meet DORA requirements.
• Legal support in setting up internal processes and contractual relationships with vendors.
• Tailored regulations – the documentation is designed to comply with the regulation’s requirements while remaining flexible and easily adaptable to the specific needs of your company.

Be Prepared

The DORA regulation will come into effect on January 17, 2025. The sooner you begin its implementation, the better prepared you will be for potential audits and inspections by the Czech National Bank as the supervisory authority.

Do not hesitate to contact us for more information and collaboration. With our assistance, you will be fully compliant with DORA requirements and ready for the future of the digital world.