Call us now:
I thought that I should post the EU DORA text, as it is worth reading from page 38(article 1). The EU Digital Operational Resilience Act is one of a number of pieces of legislation the EU is working on to address cybersecurity risk management that include EU NIST 2.0 and the Cybersecurity Resilience Act(CRA).
Legislation that has similarities, focusing on cybersecurity risk management (2nd Line of Defence), requiring boards to demonstrate they are taking an active role in the oversight and assurance or cybersecurity. Requiring organisations to adopt a cybersecurity risk management framework and implement cybersecurity standards. Boards to facilitate independent oversight, assurance and attestation of cybersecurity compliance (3rd Line of Defence). Board members of CNI providers, covered Financial Institutions (FIs), manufacturers and distributors of digitally enabled products and services to be held accountable and responsible for cybersecurity risk management compliance.
DORA along with EU NIS 2.0, the CRA and the SEC cybersecurity Risk management proposal significantly increasing board legal and compliance risk. While DORA focuses on FI ICT risk management and ICT risk management of FI third party vendors (including cloud), one would hope that systemically important FIs in the EU manage ICT risk through their current Basel III programs.
In the case of U.S cyber legal risk, precedence for CISOs, CEOs and claims under the False Claims Act (FCA) is being set. With both the DoJ and DoT implementing cyber regimes to oversight cyber compliance. That international organisations should be aware of.
Ted Dziekanowski
Philippe Mocquard
#cybersecurity #cyberriskmanagement #cyberlegal #governance
View Original Post
https://www.linkedin.com/feed/update/urn%3Ali%3AugcPost%3A6999009075409645568