The Digital Operational Resilience Act (DORA) is a European regulation that is effective as of Jan. 17, 2025 is in effect and aims to increase the digital resilience of financial institutions

This legislation sets requirements for the security of network and information systems so that they can withstand disruptions and cyber attacks. Although DORA is aimed primarily at financial institutions, it also has significant implications for IT vendors who provide their services to these institutions

Impact on IT vendors

DORA applies to a wide range of ICT services provided by ICT suppliers to financial institutions within the EU. These include Software-as-a-Service (SaaS), Platform-as-a-Service (PaaS), Infrastructure-as-a-Service (IaaS), software, cybersecurity services, data center services, data analytics services and managed services such as network management. Even digital doorbells, thermometers and pinkassa can qualify as ICT services under DORA

Obligations for IT vendors

At all times, a financial institution is responsible for complying with and monitoring its obligations under DORA. Therefore, they will contact their existing and potential ICT suppliers to ensure their compliance with information security standards.

ICT vendors can expect the following topics to be addressed:

• Risk assessment and due diligence.: Before contracting, the financial institution should conduct due diligence to ensure that the IT vendor is suitable and meets information security standards.
• Continuity and resilience: Assessment of the IT vendor's risk management and business continuity measures to ensure the operational resilience of the financial institution.
• Subcontractors: Requests for information from the financial institution on the use of subcontractors used by the IT vendor.

DORA introduces new requirements and contractual adjustments that ICT suppliers must implement to support their customers in increasing their digital resilience. It is essential for ICT suppliers to be aware of these obligations and take proactive measures to meet the requirements of DORA.

At Analyst ICT, we have prepared ourselves by ensuring that we comply with ISO 27001, NEN 7510 and ISO 9001 standards. What this all means and how we have arranged this, we would be happy to discuss with you. Superlogic right?