DORA (Digital Operational Resilience Act) establishes the principles and procedures that financial organizations must follow to protect their networks and information systems.
DORA · Regulation (EU) 2022/2554
DORA Implementation
DORA underscores the importance of research and innovation in consolidating the European Union's economic competitiveness, emphasizing cooperation between Member States to promote a more robust and equitable financial environment.
Phase I, Gap Analysis
DORA compliance assessment
Phase II, Action Plan
Recommendations and monitoring
The regulations
What is DORA?
The Regulation
Regulation (EU) 2022/2554, adopted on December 14, 2022, introduces a comprehensive regulatory framework to enhance the digital operational resilience of EU financial entities.
Structure
Nine chapters and five thematic areas: ICT risk management, incident reporting, operational resilience testing, and oversight of third-party providers.
Objectives
To unify ICT risk management requirements into a single standard and strengthen the stability of financial entities.
Applicability
Scope of application
This regulation has a broad scope, covering various entities in the financial sector within the European Union. These include:
Banking entities
Both commercial and investment banks.
Insurance companies
Responsible for providing coverage against various risks.
Investment fund managers
Managers of collective portfolios.
Securities firms
Involved in financial intermediation.
Electronic trading platforms
Facilitators of financial asset trading.
Securities clearing and settlement service providers
Responsible for the settlement of securities transactions.
Credit rating agencies
Entities that issue ratings on the financial solvency of institutions and issuers.
Our Service
Scope of Service
DORA introduces a set of rules designed to ensure that financial entities are capable of withstanding and recovering from potential incidents affecting their digital infrastructure. To support organizations in this compliance process, we offer a specialized Gap Analysis service and the development of a personalized Action Plan. This detailed process will help companies identify areas for improvement and implement the necessary measures to meet the regulation's requirements. Our service is designed to fit the specific needs of each organization, ensuring an approach adapted to each client's particular reality.
Our services
How we work
01Gap Analysis
The first step is a project kickoff meeting where the logistics of the project will be established and any questions that may arise will be resolved. Subsequently, a detailed analysis of the organization's level of compliance with the requirements established by DORA will be conducted.
The Gap Analysis will focus on reviewing key aspects, such as ICT risk management, internal audits, and operational continuity plans. During this phase, existing documentation will be evaluated and potential gaps that need to be corrected to comply with the regulation will be identified.
The Gap Analysis will focus on reviewing key aspects, such as ICT risk management, internal audits, and operational continuity plans. During this phase, existing documentation will be evaluated and potential gaps that need to be corrected to comply with the regulation will be identified.
02Action Plan
Based on the findings of the Gap analysis, we will prepare a detailed report that will include a corrective Action Plan. This report will not only identify areas where the organization is not DORA-compliant, but will also provide specific recommendations to address the deficiencies found. Implementation of the plan will be monitored to ensure effective compliance before the final deadline.
03Results
Documentation delivered
During the project development, we will deliver the following documentation:
At the end of the project, we will organize a closing meeting where the results will be discussed and any final questions that may arise will be addressed. This formal closure will mark the full fulfillment of contractual obligations and ensure that the organization is prepared to face the challenges of digital operational resilience.
During the project development, we will deliver the following documentation:
- Phase I: Project kickoff presentation and DORA applicability assessment.
- Phase II: Analysis report and Action Plan, including details on requirements, documentary evidence, stakeholders, and compliance status.
At the end of the project, we will organize a closing meeting where the results will be discussed and any final questions that may arise will be addressed. This formal closure will mark the full fulfillment of contractual obligations and ensure that the organization is prepared to face the challenges of digital operational resilience.
Scope of service
What this service covers
ICT risk management
Technology risk management framework with policies, procedures, and controls to protect information systems and networks.
Operational continuity
Business continuity and disaster recovery plans to ensure operations in the event of digital incidents.
Internal audits
Internal compliance review of the requirements of the DORA Regulation and its 9 chapters.
Gap analysis and action plan
Gap analysis against DORA requirements with detailed report and corrective action plan.
Testimonials
What our clients say
Working with Internet Security Auditors has been a highly satisfactory experience. Their support in migrating to the ISO/IEC 27001:2022 standard, conducting internal audits, and the PCI DSS certification process has been fundamental in strengthening our information security management system.
The strategic support of Internet Security Auditors as CISOaaS has been fundamental in strengthening our internal team. Their expertise perfectly complements our CISO's work and has allowed us to advance more quickly in our cybersecurity maturity.
On behalf of Outsourcing SAS BIC, we would like to express our gratitude for your commitment and dedication during the implementation of PCI DSS compliance in our call center. We succeeded in establishing a secure environment in accordance with the most demanding requirements of the payment industry.
Working with Internet Security Auditors has been a positive experience in every respect. Their team combines solid technical expertise with a great willingness to collaborate, which has strengthened our security posture and regulatory compliance.
As CFO of Saint Louis University – Madrid Campus, I have had the opportunity to work with Internet Security Auditors. They have been our indispensable partner in implementing the requirements set out by GDPR regulations. I would like to highlight their availability to resolve questions and their ability to develop a legal framework with concrete and understandable actions…
As CFO of Fleurop - Interflora Spain, we have been working with Internet Security Auditors for years in the areas of consulting and GDPR compliance. As Interflora is a company 100% oriented towards online commerce, the professional services of Internet Security Auditors provide us with support, security, and the peace of mind that all of our activity is aligned with GDPR compliance.
As CISO at Intaremit S.A., we place the utmost importance on logical security. This is not only due to the fact that PCI-CPP regulations require us to perform four internal and external vulnerability scans and an annual internal and external penetration test, but also because of the security and peace of mind our company aims to provide to each and every one of its clients. We have been working and collaborating with Internet Security Auditors for over 10 years due to their experience, commitment, and accessibility; therefore, I recommend them without hesitation.
At Grupo Arbulu, we have collaborated closely with Internet Security Auditors on the implementation of advanced cybersecurity measures. Thanks to their expertise, we have significantly improved our ability to detect and mitigate cyber risks. Their comprehensive audits and customized solutions have strengthened our security infrastructure, ensuring the protection of our data and the continuity of our operations.
As CEO of Beruby, we worked with Internet Security Auditors when we urgently needed to perform a PCI DSS Attestation of Compliance. The entire process was extremely fast, efficient, and professional. Their team provided us with excellent support, demonstrating great technical knowledge and commitment. We undoubtedly recommend their services to any company in need of cybersecurity solutions.
At Grupo AR, we highly value the brand protection service provided by Internet Security Auditors for its comprehensive and proactive approach. Their highly qualified team enables us to identify and mitigate risks that could affect the AR Construcciones brand and its various companies.
Frequently Asked Questions
We answer your questions
What is the DORA Regulation?
DORA (Digital Operational Resilience Act) is Regulation (EU) 2022/2554, a comprehensive regulatory framework that establishes requirements to enhance the digital operational resilience of financial entities in the European Union. It covers ICT risk management, incident reporting, resilience testing, and ICT third-party risk management.
Which entities does DORA apply to?
DORA applies to banking entities, insurance companies, investment fund managers, investment firms, electronic trading platforms, central securities depositories, and credit rating agencies, among other entities in the financial sector.
What are the DORA compliance deadlines?
DORA entered into force on January 16, 2023, establishing a 2-year adaptation period. The compliance deadline was January 17, 2025. Affected entities must have all the regulation's requirements implemented.
What are the main pillars of DORA?
DORA is structured into 9 chapters and 5 main thematic areas: ICT risk management, reporting and monitoring of ICT-related incidents, digital operational resilience testing, management of risk derived from third-party ICT service providers, and information sharing on cyber threats.
How does DORA relate to other regulations such as NIS2?
DORA is a sector-specific regulation for the financial industry that complements the EU's general cybersecurity framework. While NIS2 establishes horizontal cybersecurity requirements across multiple sectors, DORA delves into specific digital operational resilience requirements for financial entities.
Contact
Do you need to implement the DORA Regulation?
Tell us about your situation and our team will get in touch with you to provide guidance or schedule a technical call.
Request information
Global Presence
Our offices
Bogotá
Transversal 22 # 98-82, Porta 100 Building, Office 1003
110221 Bogotá (Colombia)
25
years of experience in cybersecurity
Contact us