Implement EU DORA: Digital Operational Resilience Act

Review the Dora framework to grasp ICT risk management, third-party risk, and incident reporting, and determine applicability to your organization for a compliant, resilient system.

Identify whether DORA applies to your organization as a financial institution or ICT provider, then evaluate your services and third-party contracts for resilience and incident reporting.

Assign key roles and establish a DORA compliance committee to monitor ICT risk, ensure accountability across IT and compliance teams, and align all activities with DORA requirements.

Establish a Dora compliance committee with members from information technology, risk management, compliance and vendor management to monitor Dora implementation and coordinate policy updates, tests, incident response, and regulatory updates.

Develop a comprehensive ict risk policy, perform an initial risk assessment to identify cyber threats, data breaches, and outages, and implement monitoring, reporting, and tailored controls.

Identify cyber, operational, and third-party risks to digital infrastructure, categorize them, and prioritize by severity and likelihood to strengthen DORA compliance.

Define and implement ICT incident response procedures with clear escalation paths, assigned roles, and strict timelines, and establish a Dora-aligned incident reporting framework using a standardized template.

Set up a standardized incident reporting framework with a clear template covering nature, systems affected, severity, and containment. Ensure reporting within 24–72 hours and escalate to compliance and regulators.

Deploy continuous monitoring tools to gain insights, detect unauthorized access and anomalies, and ensure a dedicated team reviews logs to address threats, regulatory requirements for real-time threat detection and response.

Schedule regular ICT resilience testing and continuous monitoring to protect core banking systems, payment gateways, data storage, and CRM, using annual or biannual penetration and stress tests.

Evaluate third-party ICT service providers, including cloud services and software vendors, to assess resilience and security standards and draft contracts with resilience clauses for incident reporting and audit rights.

Draft contracts with resilience clauses for incident reporting and immediate notice to Fingard of ICT incidents, plus audit rights and continuity, backups, and disaster recovery aligned with Fingard's resilience strategy.

Develop a role-specific internal training program for ICT security, incident reporting, and third party risk management to ensure Dora compliance and operational resilience, with regular simulations.

Conduct simulations and drills to test ICT incident response for cyber attacks, outages, and data breaches, enabling teams to practice roles, identify gaps, and refine processes.

Schedule regular compliance reviews through quarterly or annual internal audits to assess Dora adherence, improve cybersecurity, incident management, and third-party risk, and document findings with corrective actions.

Document all compliance efforts with detailed records of policies, incident responses, risk assessments, and mitigation actions. Organize documentation for Dora audits to demonstrate regulatory adherence.

Prepare for Dora audits by collecting and organizing incident reports, risk assessments, and compliance records, coordinating IT security, risk management, and policy explanations.