Digital Operational Resilience Act (DORA) - Roles

Digital Operational Resilience Act (DORA) establishes a regulatory framework aimed at ensuring that financial institutions within the European Union can withstand, respond to, and recover from all types of ICT-related disruptions. The Act outlines various roles and responsibilities that are essential for achieving its objectives. Below is an overview of the key roles defined under DORA:

1. Financial Entities

• Definition: Financial entities include banks, insurance companies, investment firms, payment service providers, e-money institutions, and other entities engaged in financial activities.
• Responsibilities:
  • Establish and maintain a robust ICT risk management framework.
  • Implement measures to ensure operational resilience against ICT risks.
  • Report significant ICT incidents to the relevant authorities as per the guidelines.

2. ICT Service Providers

• Definition: These are third-party service providers offering ICT services to financial entities, such as cloud service providers, data centres, and software providers.
• Responsibilities:
  • Ensure the security and resilience of the services provided to financial entities.
  • Comply with the requirements set forth in DORA regarding operational resilience.
  • Facilitate cooperation with financial entities in the event of incidents.

3. Competent Authorities

• Definition: National regulatory bodies designated by EU member states to supervise the financial entities within their jurisdiction.
• Responsibilities:
  • Oversee and enforce compliance with DORA among financial entities and ICT service providers.
  • Monitor the operational resilience and risk management practices of financial institutions.
  • Provide guidance and support to entities in implementing DORA requirements.

4. European Supervisory Authorities (ESAs)

• Definition: Comprises three authorities: the European Banking Authority (EBA), the European Securities and Markets Authority (ESMA), and the European Insurance and Occupational Pensions Authority (EIOPA).
• Responsibilities:
  • Develop technical standards, guidelines, and recommendations to support the implementation of DORA across the EU.
  • Facilitate coordination among national competent authorities.
  • Issue reports and analysis on the state of operational resilience within the financial sector.

5. Incident Reporting Authorities

• Definition: Authorities responsible for receiving and managing reports of significant ICT incidents from financial entities.
• Responsibilities:
  • Assess the reported incidents and coordinate responses as necessary.
  • Ensure that lessons learned from incidents are communicated to financial entities to enhance resilience.

6. Board of Directors and Senior Management

• Definition: Leadership within financial entities responsible for overall governance and decision-making.
• Responsibilities:
  • Set the strategic direction for ICT risk management and operational resilience.
  • Ensure that sufficient resources are allocated to implement and maintain resilience measures.
  • Oversee the effectiveness of the organisation's ICT risk management framework.

Summary

The roles defined under DORA are pivotal for enhancing the digital operational resilience of the financial sector within the EU. By delineating responsibilities among financial entities, ICT service providers, regulatory bodies, and management, DORA aims to create a robust framework that promotes effective risk management practices and incident response strategies. Understanding these roles is essential for organisations to navigate compliance requirements effectively and strengthen their operational resilience against ICT disruptions.