Back to Resource Center
Back to Resource Center
The Digital Operational Resilience Act (DORA) guide
Table of Contents

Introduction

The Digital Operational Resilience Act (DORA) is a landmark regulation introduced by the European Union (EU) to strengthen the cybersecurity and operational resilience of the financial sector. Enacted on January 16, 2023, DORA will apply to financial entities and their ICT service providers starting January 17, 2025.

DORA establishes a unified framework for managing digital risks, ensuring financial organisations, including banks, insurers, investment firms, and other entities can operate securely through disruptions. Covering 20 categories of financial entities and their third-party providers, the act sets clear, consistent requirements to safeguard critical systems and protect against cyber threats.

What makes DORA different

Previous efforts to strengthen the financial sector against cyber threats, like those from the Financial Conduct Authority (FCA), have been criticized as fragmented and overly complex.

In contrast, the Digital Operational Resilience Act (DORA) offers a unified, practical framework that simplifies and enhances cybersecurity and digital resilience for financial institutions.

How does DORA relate to email and domain security?

Email and domain protection are critical components of preparing for DORA, as nearly 90% of cyberattacks originate from weaknesses in email security. One of the most common and damaging threats is Business Email Compromise (BEC), a targeted phishing attack often enabled by domain spoofing that saw over 50% growth in the last year within the financial sector.

These attacks often take the form of Vendor Fraud or CEO Fraud which threatens business continuity and operational resilience daily. Often what makes these successful is ‘domain spoofing.’ This is when a cybercriminal impersonates a business’ domain to send phishing emails to its customers, employees, and supply chain. The fake emails are hard for the recipient to spot because they come from a legitimate email address.

Email_Impersonation_Fake_CEOEmail_Impersonation_Fake_CEO

Moreover, the use of phishing by bad actors resulted in the highest levels of malicious traffic for the financial sector according to research conducted by CISCO, at 46%.

The data is clear, securing your email and domain security will help achieve compliance with DORA. Organisations impacted by DORA will need to take action and implement security measures which include:

1. Securing email – the primary communication medium

Email remains the dominant medium for business communication, with over 333 billion emails sent every day in 2022, making it a prime target for cyberattacks such as BEC. DORA stresses the criticality of protecting financial institutions' communications channels, including the recommendation of adopting email security measures like Domain-Based Message Authentication, Reporting, and Conformance (DMARC). These measures support compliance with DORA’s broader mandate to mitigate cyber risks and enhance digital resilience while protecting against domain spoofing and ensuring the authenticity of email communications.

2. Recognising and mitigating identifiable threats

Since 2015, the Federal Bureau of Investigations (FBI) has consistently flagged BEC as a top threat vector in its IC3 Internet Crime Report. Under DORA, financial entities must treat BEC as a “reasonably identifiable circumstance” and take proactive steps to mitigate its risks.

DORA requires organisations to identify and address reasonably identifiable circumstances that could compromise digital operational security. Given the prevalence of BEC attacks, financial entities are expected to proactively implement safeguards against such threats, including advanced email authentication protocols and employee training programs.

3. Detecting anomalies and suspicious  activities

To comply with DORA, financial institutions must establish mechanisms to promptly detect anomalous activities, such as suspicious email patterns and domain misuse. Implementing continuous monitoring tools and anomaly detection systems is essential to identify and respond to potential cyber threats in real-time.

A key defense against BEC is implementing a strong DMARC policy—ideally configured at p=reject. This ensures that unauthorized emails attempting to spoof your domain are blocked outright, protecting sensitive data, financial assets, and your organisation’s reputation.

Properly configured and managed DMARC safeguards organisations from phishing and BEC by making it significantly harder for them to spoof legitimate domains for phishing and other email-based attacks, thereby raising costs on attackers and further securing organizations. Recognised by the National Institute of Standards and Technology (NIST), and endorsed within DORA’s framework, DMARC provides a proven solution for achieving compliance and enhancing email security.

In addition to implementing DMARC, organisations can further mitigate BEC and related disruption through: 

  • Ensuring a proactive email security framework 
  • Investing in continuous monitoring tools to ensure control over outbound emails
  • Make use of security awareness training
  • Using spoof domain recognition to stop attacks before they happen

What is a reasonably identifiable circumstance?

A reasonably identifiable circumstance arises from any widely recognised vulnerability, exposure, or cyber threat. It is considered identifiable if a credible, independent authority explicitly highlights the risk to your business, providing clear notice of its potential impact. This could include common vulnerabilities or significant threats flagged by trusted cybersecurity experts or organisations.

DORA & NIST: At a quick glance

Key DORA Articles (5-50)

Digital Operational Resilience Act 2022

NIST Cybersecurity Framework 2.0

ICT

Risk Management (5 to 16)

  • Resilient ICT Systems and Tools: Organizations must set up and maintain robust ICT systems and tools designed to minimize the impact of ICT risks.
  • Continuous Monitoring: Entities are required to continuously monitor all sources of ICT risks to implement effective protection and prevention measures.
  • Anomaly Detection and Response: Mechanisms should promptly detect anomalies and suspicious activities and respond quickly and effectively to mitigate risks.
  • Business Continuity and Disaster Recovery: Comprehensive business continuity policies and disaster recovery plans should be deployed to ensure quick recovery and restoration following ICT-related incidents.
  • Learning and Evolution: Organizations must establish mechanisms to learn and evolve from both external events and their own ICT incidents to strengthen their resilience over time.
  • Communication: Effective communication channels should be maintained to address risks and disseminate necessary information to stakeholders during ICT-related events.
  • ID.RM-1: Risk management processes are established, managed, and agreed to by organizational stakeholders.
  • ID.GV-2: Cybersecurity roles and responsibilities are coordinated and aligned with internal roles and external partners.
  • PR.AC-1: Identities and credentials are issued, managed, verified, revoked, and audited for authorized devices, users, and processes.
  • PR.DS-01: The confidentiality, integrity, and availability of data-at-rest are protected.
  • PR.DS-02: The confidentiality, integrity, and availability of data-in-transit are protected.
  • PR.DS-10: The confidentiality, integrity, and availability of data-in-use are protected.

ICT-Related Incident Management Processes (17 to 23)

  • Incident Management Process: Establish processes to detect, manage, and notify ICT-related incidents.
  • Incident Classification: Define criteria and thresholds for classifying and assessing incidents.
  • Reporting Major Incidents: Submit notifications and reports of major incidents to competent authorities.
  • Harmonization of Reporting Templates: Develop standardized templates and timelines for incident reporting.
  • Centralization of Reporting: Explore the feasibility of a single EU Hub for incident reporting.
  • Supervisory Feedback: Provide guidance and share anonymized intelligence on incident trends.
  • Application to Payment-Related Incidents: Extend reporting requirements to payment-related incidents.
  • RS.CO-02: Internal and external stakeholders are notified of incidents.
  • DE.CM-01: Networks and network services are monitored to find potentially adverse events.
  • DE.AE-04: The estimated impact and scope of adverse events are understood.

DE.AE-08: Incidents are declared when adverse events meet the defined incident criteria.

General Requirements for the Performance of Digital Operational Resilience Testing

(24 to 27)

  • Digital Operational Resilience Testing: Establish and maintain a comprehensive testing program to identify and address weaknesses.
  • Testing ICT Tools and Systems: Conduct various tests, including vulnerability assessments and scenario-based tests.
  • Advanced Testing: Perform advanced testing, such as Threat-Led Penetration Testing (TLPT), for critical systems.
  • Requirements for Testers: Ensure testers meet high standards of expertise, independence, and certification.
  • ID.RA-01: Vulnerabilities in assets are identified, validated, and recorded.
  • ID.RA-05: Threats, vulnerabilities, likelihoods, and impacts are used to understand inherent risk and inform risk response prioritization.
  • ID.IM-02: Improvements are identified from security tests and exercises, including those done in coordination with suppliers and relevant third parties.
  • DE.CM-8: Vulnerability scans are performed.

General Principles for Managing ICT Third-Party Risk

(28 to 44)

  • ICT Third-Party Risk Management: Integrate third-party risk management into ICT risk frameworks and develop exit strategies.
  • Key Contractual Provisions: Define clear rights, responsibilities, and service levels in contracts with ICT third-party providers.
  • Oversight of Critical ICT Third-Party Providers: Designate and monitor critical providers for systemic importance and operational resilience.
  • Advanced Oversight Mechanisms: Conduct audits, inspections, and enforce compliance with security standards.
  • Collaboration and Coordination: Enhance information-sharing and coordination among entities, regulators, and providers.
  • GV.RM-05: Lines of communication across the organization are established for cybersecurity risks, including risks from suppliers and other third parties.
  • GV.SC-05: Requirements to address cybersecurity risks in supply chains are established, prioritized, and integrated into contracts and other types of agreements with suppliers and other relevant third parties.
  • GV.SC-07: The risks posed by a supplier, their products and services, and other third parties are understood, recorded, prioritized, assessed, responded to, and monitored over the course of the relationship.
  • GV.SC-10: Cybersecurity supply chain risk management plans include provisions for activities that occur after the conclusion of a partnership or service agreement.

Authorities and Information Sharing (45-50)

  • Supervisory Powers: Authorities can enforce compliance through inspections, audits, and corrective measures.
  • Cooperation: Authorities coordinate and share information for effective supervision.
  • Sanctions: Non-compliance results in penalties and corrective actions.
  • Right to Appeal: Entities can challenge supervisory decisions.
  • Data Protection: Activities must comply with EU data protection laws.
  • Confidentiality: Sensitive information from supervisory activities must remain confidential.
  • DE.AE-03: Information is correlated from multiple sources.
  • DE.AE-06: Information on adverse events is provided to authorized staff and tools.
  • RS.MA-01: The incident response plan is executed in coordination with relevant third parties once an incident is declared.

What are the benefits of the DORA?

Thanks to DORA, businesses will be enabled to make better decisions as DORA highlights what they need to do in one place, and leaves nothing out. What’s more, by complying with the provisions outlined in DORA, businesses may expect more predictable outcomes while becoming more resilient to cyberattacks and other ICT threats. Other benefits of this European parliament legislation include:

  • Enhanced stability and security across supply chains
  • Improved planning and execution of exit strategies
  • Stronger ability to defend against and respond to attacks
  • Increased protection against opportunistic cybercriminals
  • Defense in the event of an attack
  • Reduce business disruption and protect continuity

Who is affected by DORA?

DORA applies to two main groups of businesses.

The first group includes financial entities involved in managing, transferring, holding, insuring, investing, protecting, or raising funds, and those evaluating investments. This encompasses:

  • Banks
  • Auditors and Audit Firms
  • Investment Firms
  • Management Companies
  • Credit Institutions
  • Insurance & Reinsurance Firms
  • Brokers
  • Credit Rating Agencies
  • Crowdfunding Platforms
  • Trading Venues
  • Trade Repositories
  • Crypto-Asset Service Providers

The second group covers ICT third-party service providers that support the financial sector with software solutions, but not hardware. These include but are not limited to:

  • Account Information Service Providers
  • Central Counterparties
  • Cloud Computing Services
  • Central Securities Depositories
  • Credit institutions
  • Credit Rating Agencies
  • Crowdfunding Service Providers
  • Crypto-Asset Providers
  • Data Analytics Providers
  • Data Centers
  • Data Reporting Service Providers
  • Electronic Money Institutions
  • Insurance and Reinsurance
  • Insurance Intermediaries
  • Investment Firms
  • Management Companies (Assets)
  • Managers of Alternative Investment Funds
  • Payment Institutions
  • Providers of Digital and Data Services
  • Software Developers
  • Trade Repositories
  • Trading Venues
  • Third Party Service ICT Providers
  • Third Party ICT Vendors

While the above businesses are impacted due to their location within the EU, the act also applies to any business outside of the EU that wishes to work with a business that has offices within the EU. For example, if an investment firm headquartered in the US wanted to access clients based in the EU or had offices in the EU, they would need to comply with DORA.

Financial institutions and certain third-party service providers (TSPs) required actions:

  • Identify and assess their digital operational risks.
  • Implement appropriate measures to mitigate their digital operational risks.
  • Report certain digital operational incidents to their national competent authorities.
  • Cooperate with their national competent authorities in the event of a digital operational incident.

TSPs that are considered to be critical by their national competent authorities will be subject to additional requirements, such as:

  • Designating a senior manager responsible for digital operational resilience.
  • Providing their customers with information about their digital operational resilience.
  • Undergoing regular assessments of their digital operational resilience.

Third-party ICT service providers designated as "critical" by the European Supervisory Authorities (ESAs) may face fines of up to EUR 5,000,000 or, in the case of an individual, a maximum fine of EUR 500,000 for non-compliance with the Act's requirements. The ESAs will have the authority to impose these fines.

What happens if you don’t comply with DORA?

Compliance with DORA is not optional for businesses operating in or serving the EU financial sector. The regulation places direct responsibility on an organisation’s board and executive members to implement robust measures to mitigate cyber risks and safeguard operational resilience.

Failure to address risks, particularly those identified as reasonably identifiable circumstances, can result in severe consequences which include:

DORA_compliance_failureDORA_compliance_failure

Penalties can reach up to 2% of a company's total annual global turnover, or 1% of an entity's average daily turnover.Individuals and entities could face fines up to €1.000.000. The exact penalty amount will depend on the severity and nature of the DORA violation. The European Supervisory Authorities (ESAs) are responsible for compliance and penalties.

Are DORA and the NIST Cybersecurity Framework (CSF) the same?

In short, no. However DORA aligns with the NIST Cybersecurity Framework 2.0 (CSF) in a number of important ways. Both frameworks emphasize the importance of:

  • Identifying and assessing cybersecurity risks: DORA requires organizations to identify and assess their cybersecurity risks, and the NIST CSF calls for organizations to do the same.
  • Implementing appropriate controls: DORA requires organizations to implement appropriate controls to mitigate their cybersecurity risks, and the NIST CSF recommends that organizations do the same.
  • Monitoring and responding to cybersecurity incidents: DORA requires organizations to monitor their systems for cybersecurity incidents and to respond to incidents promptly and effectively, and the NIST CSF calls for organizations to do the same.
  • Continuous improvement: Both DORA and the NIST CSF emphasize the importance of continuous improvement in cybersecurity practices.

In addition to these general similarities, DORA also aligns with the NIST CSF in a number of specific ways. For example, both frameworks call for organizations to:

  • Establish a cybersecurity risk management program: DORA requires organizations to establish and maintain a cybersecurity risk management program, and the CSF recommends that organizations do the same.
  • Appoint a senior officer for cybersecurity concerns: DORA requires organizations to designate a senior executive to oversee the organization's cybersecurity program, and the CSF recommends that organizations appoint a CISO or other senior-level executive to do the same.
  • Conduct cybersecurity training for employees: DORA requires organizations to provide cybersecurity training to their employees, and the CSF recommends that organizations do the same.
  • Report cybersecurity incidents to the appropriate authorities: DORA requires organizations to report cybersecurity incidents to the relevant authorities, and the CSF recommends that organizations do the same.

How can Red Sift help?

A critical part of preparing for DORA starts with securing your email systems, and one of the most effective ways to achieve compliance is through robust DMARC implementation. Red Sift OnDMARC gives you full control of your outbound email communications and insight into your digital estate.  With its intuitive, cloud-based dashboard, you can easily manage DMARC, DKIM, and SPF records without the need to navigate DNS settings.

OnDMARC helps organisations address key DORA requirements by:

  • Implementing a proactive email security framework: OnDMARC provides a clear pathway to achieving DMARC p=reject, ensuring unauthorised emails are blocked in order to protect your business from BEC and phishing.
  • Streamlining oversight: OnDMARC offers visibility into your outbound emails, helping you monitor and resolve issues quickly.
  • Pinpointing suspicious activity: Powered by machine learning, OnDMARC’s forensic reporting feature delivers relevant and granular information about your sending sources, enabling you to pinpoint and solve issues quickly. 

Learn more about OnDMARC’s full benefits and prepare for DORA by signing up today!

Is there any further guidance around DORA?

The following organisations have set our guidance concerning DORA and how it may impact your business:

LinkedInInstagram