DORA: 3 Strategies for Meeting Compliance

For financial services organizations that do business in the European Union (EU), 2025 is the year of DORA -- the Digital Operational Resilience Act.

In a previous blog, A Game-Changer in EU Financial Cybersecurity and Resilience, I provided background on DORA, why it was established, and the specific requirements organizations need to know. Today, I will provide three strategies financial organizations can use to maintain DORA compliance and harden their cyber and operational resilience.

Strategies for DORA Compliance

There are numerous ways to help your organization achieve DORA compliance. Here are three of them.

1. Use DORA as an Opportunity to Harden Operational Resilience

In the lead-up to DORA implementation, the underground chatter was there at times. “Oh, great. Yet another cybersecurity regulation that will have to be studied, broken down into requirements, and constantly monitored for compliance. Don’t we already have enough frameworks, standards and regulations to contend with?”

In today’s complex regulatory environment, that’s a worthwhile conversation. However, it’s important to note that DORA is specifically designed for the financial industry, addressing specific risks and challenges unique to the industry. Finance today is almost entirely dependent on digital transactions – more so than any other industry – and it can be helpful to address these challenges with specific guidelines and regulations aligned to unique industry use cases.

DORA is an opportunity to harden operational resilience in an extremely dynamic threat landscape. Financial organizations are big targets, and their ICT (Information and Communication Technology) infrastructures are highly distributed and complex. DORA provides a robust framework for ensuring cyber and operational resilience and provides an opportunity for financial organizations to harden their security strategies. Meeting DORA compliance requires organizations to identify risk, close security gaps and maintain good cyber hygiene. Rather than check a few boxes, security teams should use the requirements within DORA to ensure cyber and operational resilience.

2. Document Everything in a Central Repository of ICT Information

DORA requires financial organizations to record all ICT of third parties and any critical sub-contractors in a central register of information (ROI) document – including identification information of the third parties, where they are based, contact details, contractual information, scope of service provided, risk categorization, monitoring provisions and internal ownership. This repository is a great opportunity to formalize cybersecurity and risk management information regarding the supply chain for ICT, where it can be updated, referenced, and made available to authorized stakeholders inside and outside the organization.

This ROI document can be used as a playbook during attacks or other incidents, providing responders with the context they need to make quick and decisive actions in the moment. The document can also provide step-by-step instructions that preserve knowledge and expertise even if employees leave the company.

3. Focus on Third Parties and How They Impact Business Risk

The financial industry is inherently interconnected, allowing businesses, consumers and other entities to make digital transactions in near real time. This interconnectedness makes organizations dependent on third-party partners, vendors and even customers. If any of these access points are compromised, threat actors may have the ability to spread to other systems in search of additional targets, which Bitdefender has observed as an increasing trend.

DORA understands the dependence on third parties and requires organizations to better understand how their suppliers impact business risk. This includes ICT service providers, managed service providers, cloud service providers, vendors, Software as a Service (SaaS) platforms and other entities using unmanaged applications, services and devices.

But how do you know if a vendor is updating their software with the latest patches? Or if a cloud service provider is using the most advanced cybersecurity tools and techniques to keep threat actors away from your data?

Penetration testing and tabletop simulations allow security teams to probe unmanaged entities for potential vulnerabilities. Tests or simulations can be conducted to test preparedness and resilience, giving financial organizations insights into their security posture, ensuring they know how to respond in the event of an incident, together with their suppliers. These insights can then be used to address these gaps, reassess partnerships, and put positive pressure on suppliers to do better.

DORA Is More Than a Checklist

Meeting DORA compliance can be a great opportunity for financial organizations to harden their cyber and operational resilience.  Requirements stated by the regulation are specifically designed to address the challenges the finance industry faces and can be aligned with other standards or business objectives.

Organizations will ideally use DORA as an opportunity to assess risk appropriately, document a register of information (ROI), and take third-party partners and suppliers into account. Doing this within the DORA guidelines helps organizations meet the dynamic challenges financial entities face in today’s always-on, hyperconnected world.