The opinions expressed here are those of the authors. They do not necessarily reflect the views or positions of UK Finance or its members.

DORA represents a major milestone in operational risk management best practice, but it’s just the beginning for organizations operating in the EU's financial services space. 

Many will see the immediate compliance priorities for January 17th as being able to report ICT incidents, significant threats, and upload their register information. The larger task, however, is the ongoing work of managing the gaps, operationalising compliance, and maintaining robust third-party risk management processes that are relevant beyond DORA. 

DORA Market Update: Where Are Firms Currently? 

For organizations working towards DORA compliance, the process should already be underway, with the following steps to compliance completed by the January deadline. Currently, firms have their focus on: 

• Defining critical processes
• Identifying and categorizing critical service providers
• Ensuring contracts are updated
• Gathering all accurate information for the register of information

With many performing these tasks manually to align with identified gaps, we can count on seeing more firms looking to operationalise their programs and turning to technology to help. 

Leveraging DORA for Broader Compliance

Like we said, DORA is just the beginning.

Companies should stay vigilant about the introduction of complementary frameworks like MiCA and NIS2, which could impact their operations if they deal with digital assets or cross-border cybersecurity.

A proactive and comprehensive approach to risk management allows financial institutions to extend these practices to broader regulatory areas. 

For example, the incident detection and response protocols required by DORA are closely aligned with the requirements of regulations like GDPR, which also emphasizes the need for robust data protection and cybersecurity measures.

By leveraging DORA's principles to move beyond reactive compliance and towards a more integrated strategy, organizations reduce the likelihood of regulatory breaches and strengthen their ability to maintain operational integrity in the face of new challenges.

Best Practices for Long-Term Success

Cross-departmental collaboration and technology investments — involving coordinated efforts from IT, legal, risk, and operations teams — helps create a unified and efficient framework.

To implement these strategies effectively, consider the following best practices:

Risk Assessment and Mitigation:

•  Regularly assess for potential risks
•  Develop and implement mitigation strategies 

Policy Development:

• Create comprehensive security policies 
• Align policies with relevant regulatory compliance requirements

Audit Preparation:

• Create plan to be able to demonstrate understanding of gaps in compliance and present detailed remediation plans

Incident Response Plan:

• Establish a clear and efficient process for identifying, reporting, and responding to incidents
• Ensure employees understand reporting procedures

Communication Protocols:

•  Define communication channels and protocols during incidents
•  Establish roles and responsibilities within and outside the organization

Testing Framework:

• Conduct regular assessments to identify and evaluate potential threats to the digital operational resilience of your organization
• Adjust testing frequency based on organizational changes or emerging threats

Continuous Improvement:

•  Establish a process for continuous improvement based on testing outcomes
•  Regularly update and enhance digital resilience strategies

Third-Party Risk Management:

• Implement a comprehensive process for assessing third-party vendors’ security measures
• Include specific security and compliance obligations in vendor contracts

* This comes as one of the most important steps as KPMG’s survey of firms across the EU revealed that 87 per cent had only partial or no coverage for TPRM. 

A common theme for organizations (with DORA and beyond) is the difficulty of maintaining the extensive documentation. Using automation tools ensures that the information is accurate and current, avoiding the need for time-consuming manual processes. This will allow organizations to be better equipped to stay ahead of the evolving requirements of DORA today – and other regulations tomorrow. 

Want to continue the conversation? Connect with our team!