The European Union has taken a strong stand to improve operational resilience of its financial entities in a digital world. The EU Digital Operational Resilience Act that comes into effect in January 2025 aims to enforce harmonised risk regulations across the European financial sector.
In its quest to enhance Information and Communications Technology (ICT) related operational resilience, the EU DORA has many prescriptive requirements of financial entities. The important thing to note is that the DORA mandate goes beyond the financial entities themselves. DORA lays a lot of emphasis on the risk management capabilities of the ICT service providers and infrastructure that supports EU financial institutions.
If you’re a business based in the UK, you may think you are not directly impacted by DORA. But guess what - you probably are. There are several ways, direct and indirect, in which the implications of the EU DORA go beyond just the European Union.
Take a look below at the 3 main ways in which DORA will impact businesses in the UK.
Our recommendation? Regardless of whether you figure out you’re being impacted or not, let the EU DORA be that trigger for accelerating your cyber resilience maturity. Whether you’re currently being affected by DORA implementation or not, in an increasingly globalised world, you may soon feel its effects. What’s more? Many sources have been suggesting since 2022 that a UK-equivalent of DORA may be expected to emerge soon too.
So what can you do and how do you up your operational resilience maturity levels? More on that later.
Topics covered in this article:
1. Top 3 ways in which EU DORA impacts UK businesses
2. How can UK businesses become DORA compliant?
Since DORA places stringent scrutiny requirements for subcontractors too, you may not directly be providing services to EU financial institutions, and yet you could be impacted by DORA requirements.
#2. Cost of Compliance: With any upcoming regulatory requirement or update to existing regulations, there is always an impending cost of compliance. And that will also be the case of UK businesses impacted by DORA.
On the subject of third-party ICT providers, DORA says, “Financial entities may only enter into contractual arrangements with ICT third-party service providers that comply with appropriate information security standards.” [Chapter V, Section 1, Article 28]
This indicates that DORA expects every third-party service provider, whether in the EU or outside it, to comply with its exacting standards of digital operational resilience.
However, it further adds that contractual agreements with third-parties must include “requirements for the ICT third-party service provider to implement and test business contingency plans and to have in place ICT security measures, tools and policies that provide an appropriate level of security for the provision of services by the financial entity in line with its regulatory framework.” [Chapter V, Section 1, Article 30]
This means that businesses in the UK also need robust Cyber Incident Response Plans, policies and processes. They also need to test the effectiveness of these plans through regular operational resilience tests such as Penetration tests and scenario-based Cyber Tabletop Exercises. For more information on how to conduct these digital operational resilience tests, read our detailed blog on EU DORA and Cyber Tabletop Testing for Operational Resilience.
#3. Impact on Opportunities in the EU: This one is quite straightforward. If you’re looking to do business on a global level, including in the EU, you have to comply with the standards that DORA mandates for third-parties. This is especially true for technology providers and those who will come under the category of critical infrastructure support.
Many experts are suggesting that the EU DORA standards will soon serve as a global benchmark. In order to remain competitive globally, it will be advisable to at least achieve the basic requirements that DORA has laid out. Several organisations across the world may soon prefer to partner with ICT service providers who meet DORA standards, not just out of regulatory obligations, but as a way to secure their supply chain as far as possible. It is then, in your business interest to use the DORA mandate as a yardstick and enhance your cyber resilience posture accordingly to remain relevant, not just in the EU but the world over.
If you’re a UK-based financial institution that operates in the EU, you have to achieve DORA compliance - there’s no two ways about it. You need to work on your ICT Risk Management framework, Cyber Incident Reporting and Operational Digital Resilience Testing with immediate effect.
If you’re a third-party service provider, you need to ensure that you meet the standards laid out by DORA for the supply chain in order to remain competitive. Some of the steps you can take immediately to achieve this goal include: