Financial Sector Adds New Regulations, DORA Compliance, For 2025
DORA is a new law that started on January 17, 2025, for financial companies and IT service providers. It’s like a rulebook that says how financial companies should report problems, test how well they can handle disruptions, and manage risks from IT service providers. Here are some important things to keep in mind when choosing a third-party IT service provider to help you achieve DORA compliance.
Understanding DORA Compliance
Compliancy regulations across many industries and sectors will become more astringent in 2025. DORA applies to financial companies in the EU and their important IT service providers, even if they’re outside the EU. But, where should you start?
- Managing IT risks – Identifying potential IT threats and ensuring your company has a solid plan to mitigate them.
- Handling IT issues – Addressing any problems that arise with IT services quickly and effectively.
- Reporting IT problems – Communicating IT issues to the appropriate teams within your company to ensure timely resolution.
- Testing resilience – Assessing your company’s ability to handle IT disruptions and ensuring preparedness for unexpected challenges.
- Managing risks from IT service providers – Establishing safeguards to protect your company from potential risks associated with external IT service providers.
- Collaborating with IT service providers – Sharing critical information to work together on problem-solving and improving service reliability.
While these key principles define a DORA compliant business, getting there can be a whole other challenge. Next, we’ll dive deeper into what you can expect from compliance-as-a-service companies like FocusConnect.
Ensuring Third-Party Compliance with DORA
Provider Oversight
Financial institutions need to keep a record of all their contracts with third-party providers, including what the services do and if they subcontract them. The service description should include details like where the service is located, what levels of service are available, how long it’s available, how important the data is, and how it’s protected. Compliance consultants can help you keep regular records that are readily available for review.
Establishing a Risk Management Framework
Financial institutions need to set up a good risk management plan that includes strategies, policies, procedures, protocols, and tools to protect information and assets. This plan should be used to evaluate third-party services, focusing on any potential problems that could affect the business, like operational or systemic risks.
Conducting Third-Party Service Evaluations
When evaluating third-party services, financial institutions should consider how important the services are, how much they could affect the business if something goes wrong, and whether they have a history of regulatory compliance and a strong track record in managing IT risks. Regular audits and performance reviews should be conducted by industry experts to ensure DORA compliance and to identify any potential weaknesses before they become critical issues.
Clear Contractual Arrangements
Contracts for services that support critical or important functions need to be clear about who’s doing what, what’s expected of them, and what happens if something goes wrong. Important things to include in the contract are service descriptions, subcontracting conditions, data processing locations, and data protection measures.
Contracts should clearly state performance targets, incident support obligations, cooperation with authorities, and rights to audits and inspections. They should also include notice periods, security measures, resilience testing participation, and exit strategies to ensure smooth transitions and minimize disruptions to financial entities.
Operational Resilience Testing
Third-party providers supporting critical or important functions must implement and regularly test business continuity plans and resilience measures to ensure uninterrupted service delivery. They are required to participate in Threat-Led Penetration Testing (TLPT), like we offer here at FocusConnect, and cooperate with financial entities in assessing their operational readiness. Providers must facilitate performance monitoring and support audits, and ensure their contingency strategies are robust enough to minimize disruptions during incidents or transitions.
Partner With Trusted Compliance Consultants
Selecting an MSP to assist your organization in implementing new regulations related to operations and safety in the finance sector is of utmost importance. Please don’t hesitate to contact our team to explore how we can support your organization and enhance your safety protocols.