DORA

DORA, are you ready for it?

The Digital Operational Resilience Act comes into force across the EU on 17 January 2025, aimed at strengthening cybersecurity across the financial industry. Failure to comply will result in severe fines and risk of reputation. Here is what financial institutions and ICT providers need to know in order become compliant with the new regulation.

Author: Shannon Dority, Marketing Manager iStorage

Financial institutions and third-party providers to the sector in the EU will soon be subjected to the Digital Operational Resilience Act (DORA). The increasing reliance on technology has made the sector increasingly vulnerable to cyber-attacks and/or disruptions. As part of Europe’s Fit for a Digital Age programme, the EU regulation aims to strengthen the financial sector through the introduction of strict cybersecurity standards. Not only are a wide range of financial institutions covered by the regulation, but also businesses of all sizes that offer critical services to the sector, even those based outside of the EU will need to comply. Failure to comply with DORA's requirements could face fines of up to two percent of their total annual worldwide turnover, and an individual faces a maximum fine of €1,000,000.

pexels-pixabay-259249

Digital Operational Resilience Act

The DORA regulation came into force on 16 January 2023 with the goal of creating a universal framework for managing and mitigating ICT risk in the financial sector, making sure it can stay resilient in the event of a severe operational disruption. The regulation comes into full effect on 17 January 2025, financial institutions and third-party providers within the EU, and those that serve these institutions from outside the EU, must comply with the new rules.

The primary focus of the regulation centres around operational resilience with five key factors organisations need to consider remaining compliant. These areas are:

1. Risk Management
2. Incident Monitoring, Reporting, Response and Crisis Management
3. Business Continuity Planning and Digital Operational Resiliency
4. Information and Intelligence Sharing
5. Third Party Risk Management

pexels-rdne-5922204

As part of creating a risk assessment process, organisations will need to conduct an impact analysis to demonstrate how specific scenarios of severe disruptions might affect the business. These include incidents such as ICT service failures, natural disasters and cyberattacks. Data backup and recovery measures, system restoration processes and plans for communicating with affected clients, partners and the authorities must be included as part of these plans. There is not a one-size-fits-all method for how this needs to be conducted, as requirements will be proportionate to the size of the business. But regardless of size, businesses will need to demonstrate their cybersecurity measures they have in place to prevent these instances, as well as have an effective plan in place to recover quickly in the event one does occur.

With data backups being a crucial part of the DORA regulation, an important way organisations can demonstrate operational resilience is by making data backups a daily task. Having multiple encrypted backups of your data and important files is a crucial safeguard in the event of a cyberattack and/or disruption, helping to save time and money in regaining access to critical information and getting your business back up and running. Using a hardware encryption module to encrypt data stored in the cloud and/or an offline encrypted backup is an important option to include in your data hygiene practices, as it can provide that extra level of reassurance and security. Taking that critical extra step, in protecting your data by storing it offline in an encrypted flash drive or portable HDD/SSD, out of the hands of criminals, can act as an essentially unbreakable safe and can make the world of difference when you need to restore your data following an ICT service failure, natural disaster, or a cyberattack.

We have a wide range of products that can suit those on a budget, with some of our hardware encrypted products starting at only £49, to desktop drives holding up to 24 TB to store your institution’s most vital data in an ultra-secure, offline device.

Our diskAshur3 range boasts the most advanced security features, recently passed the CAVP (Cryptographic Algorithm Validation Program) testing as part of the FIPS 140-3 Level 3 validation scheme that the products are currently being evaluated against. This includes three encryption modes (patent pending), and user-configurable PINs ranging from 8 to 64 digits. The new range incorporates all the essential features of other iStorage products such as ease of use, platform independence and tamper-proof sleek designs.

And our unique and patented iStorage cloudAshur hardware security module is the perfect solution for anyone wanting to securely store, share and manage data in the cloud. cloudAshur can also be used to encrypt data stored on a network drive, on a local PC/MAC and to send encrypted email attachments or data via file sharing software applications eliminating all the security vulnerabilities that exist with cloud platforms, such as lack of control, unauthorised access and human error.

If you are looking to take control of your data and how our products can help your business prepare for DORA, speak to one of our company representatives now to see what would be best for you.