DORA - Digital Operational Resilience Act for the Financial Sector

CHAPTER II of the Regulation introduces requirements related to the Information and Communication Technology Risk Management which focus on the following actions:

• Identification 
  Identification and recording of ICT-related information assets and functions.
• Protection and Prevention
  Continuous monitoring and control of the ICT systems functioning.
• Detection
  Detection of anomalous activities, network performance problems, ICT and security incidents.
• Response and Recovery
  Development and testing of Business Continuity and Disaster Recovery Plans.
• Restoration and Recovery
  ICT systems backup policies, restoration and recovery procedures.

Further details regarding these requirements are also included in the following documents related to the Regulation: 

Regulatory Technical Standards (RTS) on ICT risk management tools, methods, processes and policies and on simplified ICT risk management framework

Joint Guidelines (GLs) on estimation of aggregated annual costs and losses caused by major ICT-related incidents

CHAPTER III of the Regulation introduces requirements related to the ICT-related Incident Management, Classification and Reporting which focus on the following actions:

• Management 
  Development and implementation of an ICT-related incident detection, management and notification process.
• Classification 
  Assessment of the ICT-related incident impacts and classification based on defined criteria.
• Reporting
  Reporting of ICT-related incidents, which are classified as major, to the Bank of Greece based on the requirements of the Regulation regarding:
• The reporting deadlines (initial, intermediate and final notification).
• The content of each notification.

In the event of a major ICT-related incident, in accordance with the criteria of the Regulation, supervised institutions must send a completed relevant template, using a secure communication channel, to the following email address: ICTIncidentReporting@bankofgreece.gr. Additionally, significant cyber threats may be reported through the same secure communication channel, by sending the corresponding template. The above templates as well as the corresponding validation rules are available at the end of the website.

For the process of implementing the secure communication channel, supervised institutions may contact ict.supervision@bankofgreece.gr for instructions.

Further details regarding these requirements are also included in the following documents related to the Regulation:

Regulatory Technical Standards (RTS) specifying the criteria for the classification of ICT-related incidents and cyber threats, setting out materiality thresholds and specifying the details of reports of major incidents

Regulatory Technical Standards (RTS) specifying the content and time limits for the initial notification of, and intermediate and final report on, major ICT-related incidents, and the content of the voluntary notification for significant cyber threats

Implementing Technical Standards (ITS) with regard to the standard forms, templates, and procedures for financial entities to report a major ICT-related incident and to notify a significant cyber threat

CHAPTER IV of the Regulation introduces requirements related to the Digital Operational Resilience Testing which focus on the following actions:

• Programme 
  Development, maintenance and review of a Digital Operational Resilience Testing Programme.
• Testing
  Execution of appropriate tests on all ICT systems and applications supporting critical or important functions at least annually.
• Advanced Testing based on Threat-Led Penetration Tests (TLPT)
  Advanced testing of ICT tools, systems and processes based on Threat-Led Penetration Tests (TLPT), applicable only for the selected Financial Entities, based on the requirements of the Regulation regarding:

• The periodicity (at least every 3 years).
• The scope (some or all critical or important functions, production systems).
• The assignment of the TLPT execution (internally and/or externally).
• The reporting of findings and selected corrective actions.

Further details regarding these requirements are also included in the following document related to the Regulation:

Joint Regulatory Technical Standards (RTS) specifying elements related to threat led penetration tests

CHAPTER V of the Regulation introduces requirements related to Managing of ICT Third-Party Risk which focus on the following actions:

• Strategy and Management
  Development and review of the ICT Third-Party Risk Management Strategy and management of the related risks.
• Register of Information
  Maintenance of the Register of Information in relation to all contractual arrangements with ICT third-party service providers and regular reporting to the Bank of Greece based on the requirements of the Regulation.

The regular submission period is postponed for the period from 15 April 2025 to 25 April 2025. Institutions that have participated in the test submissions should proceed again to a regular submission of the final register of information during the regular submission period.

For the creation and submission of these registers of information, supervised institutions must apply the implementing technical standard (EU) 2024/2956, in accordance with the relevant guidelines and published answers provided in the link Preparations for reporting of DORA registers of information | European Banking Authority as well as the published answers to questions on the website of the European Insurance and Occupational Pensions Authority (EIOPA).

• Concentration Risk
  Assessment of the contractual arrangements in relation to the provision of ICT services supporting critical or important functions with the same service provider.
• Contractual Provisions
  Amendment of contracts with ICT third-party service providers in accordance with the requirements of the Regulation.

Further details regarding these requirements are also included in the following documents related to the Regulation:

Implementing Technical Standards (ITS) to establish the templates for the register of information

Regulatory Technical Standards (RTS) to specify the detailed content of the policy in relation to the contractual arrangements on the use of ICT services supporting critical or important functions provided by ICT third-party service providers

Joint Regulatory Technical Standards (RTS) on subcontracting ICT services supporting critical or important functions