This is a very important announcement by the EU.

← Back to Blog

This is a very important announcement by the EU. Coming on the same day the EU Council adopted EU NIS 2.0 it adopted the Digital Operational Resilience Act (DORA). Setting requirements for the security of network and information systems of companies and organisations operating in the financial sector, with a comprehensive scope covering FIs and critical third parties which provide their ICT related services, such as cloud platforms or data analytics services. 

DORA is a comprehensive law, setting strict cybersecurity and ICT risk management requirements, similar to those under EU NIS 2.0. DORA requires organisations to have an internal governance and controls framework to oversight ICT risks; management to approve, oversea and be held accountable for ICT risks; organisations to adopt an ICT risk management framework; standards controls policies and procedures to manage risk; demonstrated board oversight and assurance; comprehensive EU and organisation incident management and reporting; board training; regular and independent audit of ICT risk.

We have written extensively about DORA, presenting this week to the French Institute of Audit (IFACI) on DORA, EU NIS 2.0, the CRA, the SEC proposal and regulatory enforcement. The EU is developing an integrated approach to cybersecurity and ICT risk management that those who trade in and with the EU should pay close attention. While one has to note that many Financial Institutions in the EU are governed under Basel accords. DORA aims to provide an EU specific strategy for cybersecurity and ICT risk management for FIs. Also note its structure as aligned to the NIST CSF.

The EU is moving faster than the U.S with its adoption of national cyber and ICT regulation. Both are developing more comprehensive, specific and thorough cyber and ICT regulation than the UK, which could endanger UK competitive advantage.

Ted Dziekanowski Philippe Mocquard

#cybersecurity #cyberregulation #theaugustagroup #eunis2 #dora

View Original Post
https://www.linkedin.com/feed/update/urn%3Ali%3Ashare%3A7004353169912651776

Categories

Cyber Risk Management, Cybersecurity, Regulation & Compliance

Tags