DORA and ICT Risk Management: how to self-assess your compliance

TL;DR – In this blogpost, we will give you an introduction to the key requirements associated with the Risk Management Framework introduced by DORA (Digital Operational Resilience Act); 

More specifically, throughout this blogpost we will try to formulate an answer to following questions:

• What are the key requirements associated with the Risk Management Framework of DORA?
• What are the biggest challenges associated with these requirements?
• How can you prepare yourself and what are the actions that you should took in aligning your organization to the Risk Management Framework requirements?

In the following sections, we will share our thoughts on how to self-assess your compliance on this requirement. Note also that, if this self-assessment checklist is of interest to you, you will be able to find it in an excel format in our GitHub repository, here.  

What are the ICT Risk Management requirements?

DORA requires organizations to apply a strong risk-based approach in their digital operational resilience efforts. This approach is reflected in Chapter 2 of the regulation.

Chapter 2 – Section 1 – Risk management governance

The first part of Chapter 2 addresses the risk management governance requirements. They include, but are not limited to, setting roles and responsibilities of the management body, planning and periodic auditing.

This section states the responsibilities of the management body for the definition, approval, overseeing of all arrangements related to the ICT risk management framework.

This section also states the definition and attribution of the role of ICT third party Officer. This position shall be in charge of defining and monitoring all the arrangements concluded with ICT third-party service providers on the use of ICT services.

The following table provides a checklist for financial entities to self-assess their compliance on this requirement:

Article 4	Governance and organisation
Responsibilities of the management body	The management body shall define, approve, oversee and be accountable for the implementation of all arrangements related to the ICT risk management framework.
ICT third party Officer	The role of ICT third party Officer shall be defined to monitor the arrangements concluded with ICT third-party service providers on the use of ICT services
Training of the management body	The management body shall, on a regular basis, follow specific trainings related to ICT risks and their impact on the operations

Chapter 2 – Section 2 – Risk management framework

The second part of Chapter 2 introduces the ICT risk management framework itself as a critical component of the regulation.

ICT risk management requirements form a set of key principles revolving around specific functions (identification, protection and prevention, detection, response and recovery, learning and evolving and communication). Most of them are recognized by current technical standards and industry best practices, such as the NIST framework, and thus the DORA does not impose specific standardization itself.

Before exploring the functions, let’s note that DORA specifies several governance mechanisms around the risk management framework. They include, but are not limited to, setting the objectives of the risk management framework, planning and periodic auditing.

The following table provides a checklist for financial entities to self-assess their compliance on these governance requirement:

Article 5	ICT risk management framework
Protecting physical elements	Entities shall define a well-documented ICT risk management framework which shall include strategies, policies, procedures, ICT protocols and tools which are necessary to protect all relevant physical components and infrastructures
Information on ICT risks	Entities shall minimise the impact of ICT risk by deploying appropriate strategies, policies, procedures, protocols and tools
ISMS	Entities shall implement an information security management system based on recognized international standards
Three lines of defence	Entities shall ensure appropriate segregation of ICT management functions, control functions, and internal audit functions
Review	The ICT risk management framework shall be reviewed at least once a year, as well as upon the occurrence of major ICT-related incidents
Improvement	The ICT risk management framework shall be continuously improved on the basis of lessons derived from implementation and monitoring
Audit	The ICT risk management framework shall be audited on a regular basis by ICT auditors
Remediation	Entities shall define a formal follow-up process for the timely verification and remediation of critical ICT audit findings
ICT risk management framework objectives	The ICT risk management framework shall include the methods to address ICT risk and attain specific ICT objectives

Identification

Financial entities shall identify and classify the ICT-related business functions, information assets and supporting ICT resources based on which risks posed by current cyber threats and ICT vulnerabilities are identified and assessed.

The following table provides a checklist for financial entities to self-assess their compliance on the Identification requirement:

Article 7	Identification
Asset Identification	Entities shall identify and adequately document: (a) ICT-related business functions (b) Information assets supporting these functions (c) ICT system configurations and interconnections with internal and external ICT systems
Asset Classification	Entities shall classify and adequately document: (a) ICT-related business functions (b) Information assets supporting these functions (c) ICT system configurations and interconnections with internal and external ICT systems
Asset Classification Review	Entities shall review as needed, and at least yearly, the adequacy of the classification of the information assets
ICT risks Identification and Assessment	Entities shall identify all sources of ICT risks, and assess cyber threats and ICT vulnerabilities relevant to their ICT-related business functions and information assets.
ICT risks Identification and Assessment Review	Entities shall regularly review the ICT risks Identification and Assessment yearly or upon each major change in the network and information system infrastructure
ICT mapping	Entities shall identify all ICT systems accounts, the network resources and hardware equipment (a) Entities shall map physical equipment considered critical (b) Entities shall map the configuration of the ICT assets and the links and interdependencies between the different ICT assets.
ICT third-party service providers identification	Entities shall identify all ICT third-party service providers (a) Entities shall identify and document all processes that are dependent on ICT third-party service providers (b) Entities shall identify interconnections with ICT third-party service providers.
ICT third-party service providers identification review	Entities shall regularly review the  ICT third-party service providers identification
Legacy ICT systems	Entities shall on a regular basis, and at least yearly, conduct a specific ICT risk assessment on all legacy ICT systems

This ICT risk management framework shall include the identification of critical and important functions as well as the mapping of the ICT assets that underpin them. Moreover, this ICT risk management framework shall also include the assessment of all risks associated with the ICT-related business functions and information assets identified.

What to identify and assess? Well …

• ICT-related business functions
• Supporting information assets supporting these functions
• ICT system configurations
• Interconnections with internal and external systems
• Sources of ICT risk
• All ICT system accounts
• Network resources and hardware equipment
• Critical physical equipment
• All processes dependent on and interconnections with ICT third-party service providers

Protection and Prevention

Financial entities shall (based on the risk assessment) set up protection and prevention measures to ensure the resilience, continuity and availability of ICT systems. These shall include ICT  security  strategies, policies,  procedures and appropriate technologies.

The following table provides a checklist for financial entities to self-assess their compliance on this requirement:

Article 8	Protection and Prevention
CIA	Entities shall develop and document an information security policy defining rules to protect the confidentiality, integrity and availability of theirs, and their customers’ ICT resources, data and information assets;
Segmentation	Entities shall establish a sound network and infrastructure management using appropriate techniques, methods and protocols including implementing automated mechanisms to isolate affected information assets in case of cyber-attacks
Access privileges	Entities shall implement policies that limit the physical and virtual access to ICT system resources and data and establish to that effect a set of policies, procedures and controls that address access privileges
Authentication mechanisms	Entities shall implement policies and protocols for strong authentication mechanisms and dedicated controls systems to prevent access to cryptographic keys
ICT change management	Entities shall implement policies, procedures and controls for ICT change management including changes to software, hardware, firmware components, system or security changes. The ICT change management process shall be approved by appropriate lines of management and shall have specific protocols enabled for emergency changes.
Patching	Entities shall have appropriate and comprehensive policies for patches and updates

What does this entail?

• Ensuring the resilience, continuity and availability of ICT systems
• Ensuring the security, confidentiality and integrity of data
• Ensuring the continuous monitoring and control of ICT systems and tools
• Defining and implementing Information security policies such as
  • Limit physical and virtual access to ICT systems
  • Protocols on strong authentication
  • Change management
  • Patching / updates management

Detection

Financial entities shall continuously monitor and promptly detect anomalous activities, threats and compromises of the ICT environment.

The following table provides a checklist for financial entities to self-assess their compliance on this requirement:

Article 9	Detection
Detect anomalous activities	Entities shall have in place mechanisms to promptly detect anomalous activities (a) ICT network performance issues (b) ICT-related incidents
Detect single points of failure	Entities shall have in place mechanisms to identify all potential material single points of failure
Testing	All detection mechanisms shall be regularly tested
Alert mechanism	All detection mechanisms shall enable multiple layers of control (a) Define alert thresholds (b) Define criteria to trigger ICT-related incident detection (c) Define criteria to trigger ICT-related incident response processes (d) Have automatic alert mechanisms in place for relevant staff in charge of ICT-related incident response.
Trade reports checking	Entities shall have in place systems that can effectively check trade reports for completeness, identify omissions and obvious errors and request re-transmission of any such erroneous reports.

What does this entail?

• Ensure the prompt detection of anomalous activities
• Enforce multiple layers of control
• Enable the identification of single points of failure

Response and recovery (including Backup policies and recovery methods)

Financial entities shall put in place dedicated and comprehensive business continuity policies and disaster and recovery plans to adequately react to identified security incidents and to ensure the resilience, continuity and availability of ICT systems.

The following table provides a checklist for financial entities to self-assess their compliance on Response and recovery requirements:

Article 10	Response and recovery
ICT Business Continuity Policy	Entities shall put in place a dedicated and comprehensive ICT Business Continuity Policy as an integral part of the operational business continuity policy  of the entity
ICT Business Continuity Mechanisms	Entities shall implement the ICT Business Continuity Policy through appropriate and documented arrangements, plans, procedures and mechanisms aimed at: (a) recording all ICT-related incidents ; (b) ensuring the continuity of the entity’s critical functions; (c) quickly, appropriately and effectively responding to and resolving all ICT-related incidents (d) activating without delay dedicated plans that enable containment measures, processes and technologies, as well as tailored response and recovery procedures  (e) estimating preliminary impacts, damages and losses; (f) setting out communication and crisis management actions which ensure that updated information is transmitted to all relevant internal staff and external stakeholders, and reported to competent authorities
ICT Disaster Recovery Plan	Entities shall implement an associated ICT Disaster Recovery Plan
ICT Disaster Recovery Audit Review	Entities shall define a process for the ICT Disaster Recovery Plan to be subject to independent audit reviews.
ICT Business Continuity Test	Entities shall periodically test the ICT Business Continuity Policy, at least yearly and after substantive changes to the ICT systems;
ICT Disaster Recovery Test	Entities shall periodically test the ICT Disaster Recovery Plan, at least yearly and after substantive changes to the ICT systems;
Testing Plans	Entities shall include in the testing plans scenarios of cyber-attacks and switchovers between the primary ICT infrastructure and the redundant capacity, backups and redundant facilities
Crisis Communication Plans	Entities shall implement a crisis communication plan
Crisis Communication Plans Test	Entities shall periodically test the crisis communication plans, at least yearly and after substantive changes to the ICT systems;
Crisis Management Function	Entities shall have a crisis management function, which, in case of activation of their ICT Business Continuity Policy or ICT Disaster Recovery Plan, shall set out clear procedures to manage internal and external crisis communications
Records of Activities	Entities shall keep records of activities before and during disruption events when their ICT Business Continuity Policy or ICT Disaster Recovery Plan is activated.
ICT Business Continuity Policy Communication	When implementing changes to the ICT Business Continuity Policy, entities shall communicate those changes to the competent authorities
Test Communication	Entities shall define a process to provide to the competent authorities copies of the results of the ICT business continuity tests
Incident Communication	Entities shall define a process to report to competent authorities all costs and losses caused by ICT disruptions and ICT-related incidents

The following table provides a checklist for financial entities to self-assess their compliance on Backup policies requirements:

Article 11	Backup policies and recovery methods
Backup Policy	Entities shall develop a backup policy (a) specifying the scope of the data that is subject to the backup (b) specifying the minimum frequency of the backup (c) based on the criticality of information or the sensitiveness of the data
Backup Restoration	When restoring backup data using own systems, entities shall use ICT systems that have an operating environment different from the main one, that is not directly connected with the latter and that is securely protected from any unauthorized access or ICT corruption
Recovery Plans	Entities shall develop a recovery plans which enable the recovery of all transactions at the time of disruption to allow the central counterparty to continue to operate with certainty and to complete settlement on the scheduled date
Recovery Methods	Entities shall develop recovery methods to limit downtime and limited disruption
ICT third-party providers Continuity	Entities shall ensure that their ICT third-party providers maintain at least one secondary processing site endowed with resources, capabilities, functionalities and staffing arrangements sufficient and appropriate to ensure business needs
ICT third-party providers secondary processing site	Entities shall ensure that the ICT third-party provider secondary processing site is: (a) located at a geographical distance from the primary processing site (b) capable of ensuring the continuity of critical services identically to the primary site (c) immediately accessible to the entity’s staff to ensure continuity of critical services
Recovery time objectives	Entities shall determine recovery time and point objectives for each function. Such time objectives shall ensure that, in extreme scenarios, the agreed service levels are met
Recovery checks	When recovering from an ICT-related incident, entities shall perform multiple checks, including reconciliations, in order to ensure that the level of data integrity is of the highest level

How to meet the compliance on the Response and Recovery requirements?

• Define and implement an ICT Business Continuity Policy
• Define and implement an ICT Disaster Recovery Plans
• Define and implement an Back-up policies
• Develop recovery methods
• Determine flexible recovery time and point objectives for each function

Developing response and recovery strategies and plans adds an additional level of complexity, as it will require financial entities to think carefully about substitutability, including investing in backup and restoration systems, as well as assess whether – and how – certain critical functions can operate through alternative systems or methods of delivery while primary systems are checked and brought back up.

Learning and evolving

Financial entities shall include continuous learning and evolving in the internal processes in the form of information-gathering, as well as post-incident review and analysis.

The following table provides a checklist for financial entities to self-assess their compliance on this requirement:

Article 12	Learning and evolving
Risk landscape	Entities shall gather information on vulnerabilities and cyber threats, ICT-related incidents, in particular cyber-attacks, and analyse their likely impacts on their digital operational resilience.
Post ICT-related incident reviews	Entities shall put in place post ICT-related incident reviews after significant ICT disruptions of their core activities (a) analysing the causes of disruption (b) identifying required improvements to the ICT operations or within the ICT Business Continuity Policy
Post ICT-related incident reviews mechanism	Entities shall ensure the post ICT-related incident reviews determines whether the established procedures were followed and the actions taken were effective (a) the promptness in responding to security alerts and determining the impact of ICT-related incidents and their severity; (b) the quality and speed in performing forensic analysis; (c) the effectiveness of incident escalation within the financial entity; (d) the effectiveness of internal and external communication
Lessons learned from the ICT Business Continuity and ICT Disaster Recovery tests	Entities shall derive lessons from the ICT Business Continuity and ICT Disaster Recovery tests. Lessons shall be duly incorporated on a continuous basis into the ICT risk assessment process
Lessons learned reporting	Senior ICT staff shall report at least yearly to the management body on the findings derived from the lessons learned from the ICT Business Continuity and ICT Disaster Recovery tests
Monitor the effectiveness of the implementation of the digital resilience strategy	Entities shall map the evolution of ICT risks over time, analyse the frequency, types, magnitude and evolution of ICT-related incidents, in particular cyber-attacks and their patterns, with a view to understand the level of ICT risk exposure and enhance the cyber maturity and preparedness of the entity
ICT security awareness programs	Entities shall develop ICT security awareness trainings as compulsory modules in their staff training schemes
Digital operational resilience training	Entities shall develop ICT digital operational resilience trainings as compulsory modules in their staff training schemes

What does this entail?

• Ensure information gathering on vulnerabilities and cyber threats
• Ensure post-incident reviews after significant ICT disruptions
• Define a procedure for the analysis of causes of disruptions
• Define a procedure for the reporting to the management body
• Develop ICT security awareness programs and trainings

Developing an ICT security awareness programs and trainings adds another level of complexity, as DORA does not only introduces compulsory training on digital operational resilience for the management body, DORA also introduces it for the whole staff, as part of their general training package. 

Communication

Financial entities shall define a communication strategy, plans and procedures for communicating ICT-related incidents to clients, counterparts and the public

The following table provides a checklist for financial entities to self-assess their compliance on this requirement:

Article 13	Communication
Clients and counterparts communication	Entities shall have in place communication plans enabling a responsible disclosure of ICT-related incidents or major vulnerabilities to clients and counterparts as well as to the public, as appropriate.
Staff communication	Entities shall implement communication policies for staff and for external stakeholders. (a) Communication policies for staff shall take into account the need to differentiate between staff involved in the ICT risk management, in particular response and recovery, and staff that needs to be informed.
Mandate	At least one person in the entity shall be tasked with implementing the communication strategy for ICT-related incidents and fulfil the role of public and media spokesperson for that purpose.

What does this entail?

• Develop communication plans to communicate to clients, counterparts and the public
• Mandate at least one person to implement the communication strategy for ICT-related incidents

I hope you found this blogpost interesting.

Keep an eye out for the following parts! This blog post is part of a series. In the following blogposts, we will further explore the requirements associated with the Incident Management process, the Digital Operational Resilience Testing and the ICT Third-Party Risk Management of DORA.

About the Author

Nicolas is a consultant in the Cyber Strategy & Culture team at NVISO. He taps into his technical hands-on experiences as well as his managerial academic background to help organisations build out their Cyber Security Strategy. He has a strong interest IT management, Digital Transformation, Information Security and Data Protection. In his personal life, he likes adventurous vacations. He hiked several 4000+ summits around the world, and secretly dreams about one day hiking all of the top summits. In his free time, he is an academic teacher who has been teaching for 7 years at both the Solvay Brussels School of Economics and Management and the Brussels School of Engineering. 

Find out more about Nicolas on Linkedin.