Fortinet always has a sharp eye on cybersecurity developments around the world, so it’s no surprise that we are keenly aware of the European Union’s proposed Digital Operational Resiliency Act (DORA). Recently, the Council of EU presidency and the European Parliament reached a provisional agreement on DORA. It is expected pass into law by each EU member state by the end of this year.
In addition to the DORA agreement, the Council and the European Parliament also agreed on a directive to further improve the resilience and incident response capacities of the EU’s public and private sectors to cyberthreats. The NIS2 directive will formally establish the European Cyber Crises Liaison Organization Network, EU-CyCLONe, which will support the coordinated management of large-scale cybersecurity incidents.
What is the Digital Operational Resiliency Act?
DORA is designed to consolidate and upgrade information and communications technology (ICT) risk requirements across the EU financial services industry (FSI). The goal is to harmonize risk management across member states in the financial sector using one common set of standards for their operations to mitigate cybersecurity risks. Proponents of DORA say it will “make sure the financial sector in Europe is able to maintain resilient operations through a severe operational disruption.”
Why Was the Digital Operational Resiliency Act Created?
One reason for the creation of DORA is that the global pandemic accelerated digital banking. This trend of customers doing more online is prompting banks and financial services companies to respond correspondingly and accelerate their migration to the cloud and provide more digital services.
Another reason for DORA is PSD2, which is an EU directive that leveled the playing field in the financial marketplace. The objectives of PSD2 were to create a more integrated European payments market, making payments more secure and protecting consumers. The result is that new players like challenger banks and digital natives (e.g. Fintechs, BigTechs) are coming into the market and offering financial-type services to customers via APIs. This is referred to as “open banking” and it is a global trend that allows non-traditional players and banks to share customer data.
For open banking to be successful, organizations need to adopt digital platforms that facilitate cloud computing, SaaS services, and other online applications. However, due to the fact there are only a handful of cloud service providers (CSPs) on the market, EU regulators are concerned about the concentration of risk and the systemic effect on the entire financial industry if a CSP were to experience a major issue. Consequently, EU regulators are drafting DORA to mitigate these effects, prescribe best practices, and ensure a more resilient financial industry against cyberattacks.
In addition to DORA, the European Union Agency for Cybersecurity (ENISA) is in developing a cybersecurity certification process that aims to further improve the EU’s internal market conditions for cloud services by improving and simplifying the services’ cybersecurity guarantees.
What does the Digital Operational Resiliency Act Include?
Uniform ICT Risk Management and Resilience
Currently, the proposed DORA regulation reads: “Financial entities shall identify all ICT systems accounts, including those on remote sites, the network resources and hardware equipment, and shall map physical equipment considered critical. They shall map the configuration of the ICT assets and the links and interdependencies between the different ICT assets.”
The draft copy goes on to say that the EU’s financial organizations must follow a risk-based approach to “establish a sound network and infrastructure management” and use “automated mechanisms to isolate affected information assets in case of cyberattacks.”
Furthermore, European financial services organizations will be required to “design the network connection infrastructure in a way that allows it to be instantaneously severed and shall ensure its compartmentalization and segmentation, in order to minimize and prevent contagion, especially for interconnected financial processes.”
In addition to uniformed ICT risk management, Europe’s financial services organizations will be required to report all major ICT-related incidents to “the competent authorities; perform periodic digital operational resiliency testing; share information and intelligence related to cyberthreats and vulnerabilities; and measure and manage third-party ICT service provider risks.”
Regulating Third-Party Service Providers
It seems very likely that DORA will have strong effect on third-party organizations that service FSI companies. The current proposed law will require an “oversight framework for critical ICT third-party service providers when providing services to financial entities.” And there will be clear “rules on cooperation among competent authorities and rules on supervision and enforcement by competent authorities in relation to all matters covered by this Regulation.”
Additionally, in the event of an ICT cybersecurity incident, DORA requires third-party service providers to provide assistance to FSI organizations at no extra cost.
Resilience Testing and Severe Penalties
One of the key components of DORA is the digital operational resilience testing program, which calls for a broad range of assessments of European FSI organizations. The tests include “vulnerability assessments and scans, open source analyses, network security assessments, gap analyses, physical security reviews, questionnaires and scanning software solutions, source code reviews where feasible, scenario-based tests, compatibility testing, performance testing, end-to-end testing or penetration testing.”
Organizations that fail to meet DORA standards can expect to pay fines that “calculated from the date stipulated in the decision imposing the periodic penalty payment, shall be 1% of the average daily worldwide turnover of the critical ICT third-party service provider in the preceding business year.”
The drafting of DORA’s regulatory technical standards was done by the European Banking Authority (EBA), the European Securities and Markets Authority (ESMA), and the European Insurance and Occupational Pensions Authority (EIOPA) along with ENISA.
What Organizations Does the Digital Operational Resiliency Act Cover?
DORA will apply to an expansive range of FSI organizations. They will include credit institutions; payment institutions; electronic money institutions; investment firms; crypto-asset service providers, issuers of crypto-assets; central securities depositories; central counterparties; trading venues; trade repositories; managers of alternative investment funds; management companies; data reporting service providers; insurance and reinsurance undertakings; insurance intermediaries, reinsurance intermediaries and ancillary insurance; intermediaries; institutions for occupational retirement pensions; credit rating agencies; statutory auditors and audit firms; administrators of critical benchmarks; crowdfunding service providers; securitization repositories; ICT third-party service providers; and crypto assets providers.
Many of these types of organizations have not previously been subject to the ICT regulations that are within DORA’s scope. The expectation is that financial service organizations under its purview will treat DORA as a best practices guide for their industry, specifically regarding cybersecurity and resiliency.
Will There Be Global Guidance?
While DORA will be an EU regulation, its effects will go well beyond Europe’s borders. It will impact businesses and industries on a global scale, similar to how the General Data Protection Regulation (GDPR) affects countries outside of the Union since it became law in May 2018.
How Fortinet Is Prepared to Help Our FSI Customers
As usual, Fortinet is staying ahead of the curve. Before DORA becomes law, we are prepared to help our European financial services customers and global organizations that work with EU companies anticipate and respond to DORA’s demands.
Of course, Fortinet will assist our customers in monitoring networks and mitigating cyberthreats and cyberattacks. We will also help our customers comply with the DORA rules by aligning to the final version of the regulations and provide:
- Risk Management – Fortinet provides a unified risk management across environments leading to consolidation of governance, policies, and monitoring.
- Operational Resilience – Fortinet Security Fabric is the industry’s highest-performing cybersecurity platform, with a rich open ecosystem spanning over 480 security partners. It covers the extended digital attack surface and cycle, enabling self-healing security and networking to secure people, devices, and data.
- Security monitoring – Fortinet provides platforms and solutions to allow customers to monitor and track risk. FortiManager supports network operations use cases for centralized management, compliance best practices, and workflow automation to protect against advanced threat actors. The threat intelligence provided by FortiGuard Labs helps organizations stay ahead of new and existing threats.
- Digital resilience testing – Fortinet customers benefit from a long-standing commitment to meet the requirements of the most security-minded organizations. With a broad portfolio, comprehensive service offering, and a strong network of partners, Fortinet can help EU customers test their systems and networks to meet regulatory demands.
Find out more about how Fortinet secures financial services organizations from cyber threats while optimizing cost and efficiency. Also stay tuned for our financial services focused series of podcasts on this topic coming soon.