Four Months To Go: Key Steps To Implement DORA

What You Need to Know

• The Digital Operational Resilience Act ("DORA")¹ imposes new requirements on certain financial entities relating to information and communication technology ("ICT")
• Impacted firms should take certain action prior to the implementation deadline of 17 January 2025.

Background

DORA creates a European regulatory framework to strengthen the financial sector's resilience to ICT disruptions and threats². The implementation deadline is 17 January 2025.

DORA will apply to a wide range of financial entities and covers most regulated firms ("Firms"), including investment firms, fund managers, payment institutions, credit institutions, trading venues, insurance undertakings and re-insurance undertakings. It will impose new requirements on Firms relating to the management of ICT risk; ICT incidents; digital operational resilience testing; and the management of third-party ICT risk.