top of page
Search

DORA Takes Shape: New EU Guidelines & Framework Boost Financial Sector Cyber Resilience

The European Supervisory Authorities (ESAs) have recently released a series of reports and guidelines that significantly impact how financial entities (FEs) in the European Union will handle ICT incidents, cybersecurity, and third-party risk management under the Digital Operational Resilience Act (DORA).


ree


Incident Reporting & Oversight: Clearer Rules, Stronger Collaboration


Key Takeaways:


  • Standardised Incident Reporting: The ESAs have finalised guidelines on how FEs should report major ICT incidents and cyber threats. This includes standardised templates, clearer reporting timelines, and the option for aggregated reporting under certain circumstances.

  • Enhanced Oversight of Critical ICT Providers: A new framework is needed to increase oversight of critical third-party service providers (CTPPs) in the financial sector. This means greater scrutiny for those providers essential to the financial ecosystem.

  • Cooperation & Information Exchange: The new guidelines emphasise cooperation between ESAs and national competent authorities, ensuring consistent supervision and information sharing to address cyber threats.


What this means for Financial Entities:


These updates will require FEs to review and update their incident response procedures, ensure alignment with DORA reporting requirements, and potentially adapt to new information-sharing protocols.


Cost Estimation & Systemic Risk Response


Key Takeaways:


  • Cost Estimation Guidelines: The ESAs have released guidelines on how financial institutions should estimate the financial impact of major ICT incidents, helping them better understand and mitigate risks.

  • EU Systemic Cyber Incident Coordination Framework (EU-SCICF): This new framework will enhance coordination among financial authorities and relevant bodies to improve the sector's response to large-scale cyber incidents.


What this means for Financial Entities:


Financial institutions must establish or update their processes to estimate the costs of cyber incidents and potentially adapt to new reporting requirements under the EU-SCICF. The framework will help create a more resilient financial sector that is better prepared to handle systemic cyber threats.


Looking Ahead


These initiatives represent a significant step in strengthening the European financial sector's cyber resilience. They underscore the growing importance of cybersecurity in the financial world and highlight the need for ongoing vigilance and preparedness. Financial entities should proactively engage with the new guidelines and frameworks to ensure compliance, mitigate risks, and contribute to a more secure financial ecosystem.




Sign up to be notified about the latest updates of what we think

The posts listed on the 'What we think' webpages are our interpretation of regulatory developments we have been reading about. They should not be considered legal, regulatory or other advice. Contact us if you want to understand the impact of public policy, regulation and governance changes for you.

bottom of page