DORA: A paradigm shift in cybersecurity and operational resilience

In the dynamic realm of governmental regulations, the Digital Operational Resilience Act (DORA) in the EU has emerged as a game changer. Slated for application in January 2025, the buzz surrounding DORA has resonated within the information and communication technology (ICT) and financial sectors for quite some time, and its distinction lies in its holistic and authoritative approach.

DORA is heralded as the high-water mark for cybersecurity regulations tailored for the financial arena. Its mission? To redefine cybersecurity and supply risk management at a global scale, encompassing banks, insurers, pension providers, and the broader spectrum of ICTs aligned with European operations.

While DORA is a critical policy set by EU regulation, the significance of the legislation is multifaceted. DORA will thus continue to demand global attention as stakeholders across multiple lines of business within financial services will seek to get a handle on its requirements. 

Some of the key considerations include:

• Beyond EU’s borders: One pervasive myth is that the ramifications stemming from DORA are confined to the boundaries of the European Union. But that is not the case. Its requirements for network and information system security have a far-reaching scope. It extends its influence beyond EU financial institutions to include any vital third-party vendor offering ICT-related services. This includes, but isn't limited to, cloud platforms, data analytics, and SaaS offerings.

• Novel regulatory approach: DORA stands out by integrating cybersecurity requirements for both financial institutions and their supply chains, including IT vendors. Its ambition is to holistically tackle the broader issue of operational risk. In the annals of regulatory structures, DORA is the pioneer that equates cybersecurity risk with financial risk, setting an unparalleled benchmark.
• A contrasting design from US protocols: In stark contrast to many US regulations, which are often presented as voluntary industry standards or best practices, DORA takes a decidedly authoritative stance. Its mandates are compulsory, leaving little room for flexibility. The downstream effects of DORA will be numerous. Even those not directly transacting with financial entities could be impacted if they are part of the long supply chain, given that DORA mandates can be contractually imposed.

The release and timing of any features or functionality described in this post remain at Elastic's sole discretion. Any features or functionality not currently available may not be delivered on time or at all.