Preparing Your Organisation For The Digital Operational Resilience Act (DORA) Deadline

• Published date: 01 April 2024
• Law Firm: Ogier
• Author: Cian O'Gorman and Stephen N. O'Connor

The Digital Operational Resilience Act ("DORA") is a European Union ("EU") Regulation which entered into force on 16 January 2023 and is aimed at strengthening the operational resilience of the EU's financial services sector against information and communication technology ("ICT") cyber-attacks.

Organisations to which the provisions of DORA will be applicable have until 17 January 2025 - approximately 10 months from now - to implement measures to comply with the Regulation.

The purpose of DORA practically, is to ensure business continuity in circumstance of an unexpected disruption by, for example, system downtime as a result of malicious activities by unauthorised threat actors. The EU's objective in implementing DORA is to require in-scope firms to put in place measures to withstand, react to, and mitigate against cyber-related disruptions and risk.

What organisations will DORA apply to?

DORA will apply to an extensive range of financial entities based in EU member states, some examples of which are as follows:

• insurance and reinsurance undertakings
• insurance intermediaries
• crypto-asset service providers
• credit institutions
• banks
• payment institutions and electronic money institutions
• investment firms
• AIFMs and UCITS management companies and
• cloud computing...