Stay prepared and compliant with DORA: Resilience is the new standard

Financial entities must establish and maintain a comprehensive, well-documented ICT risk management framework. This ICT Risk Management framework should enable organizations to effectively identify, assess, and mitigate ICT-related risks. A key component involves determining which business functions are critical or important, then mapping the ICT assets, services, and third parties that support them. Organizations must also ensure continuity of these functions through business continuity and disaster recovery planning, regular risk assessments, and appropriate governance controls. The goal is to ensure that ICT risks are proactively managed and do not compromise operational resilience.

KPMG can support organizations in this area by performing business impact analyses, identifying critical and important functions, and mapping them against the underlying ICT services and assets. We also assist in developing business continuity plans and, most importantly, help define gaps and create practical roadmaps to implement a robust ICT risk management framework.

Under DORA, organizations are required to have processes in place to detect, classify, and report ICT-related incidents to the relevant authorities in a timely and accurate manner. DORA introduces strict reporting timelines, including a four-hour window for the initial notification of major incidents, followed by detailed status updates and root cause analysis reports. Entities must adopt standardized classification criteria to distinguish between ‘major’ and ‘non-major’ incidents and need to have escalation procedures in place. These requirements enhance transparency and allow regulators to monitor and respond to threats more effectively across the sector.

Financial entities must regularly test the resilience of their critical ICT systems and services to ensure they can withstand operational disruptions. DORA requires a risk-based testing approach, proportionate to the size, complexity, and risk profile of the entity. For organizations classified as significant, this includes conducting advanced testing such as Threat Led Penetration Testing (TLPT), which simulates real life attack scenarios. Testing must cover people, processes, and technologies, and findings should inform improvement plans to strengthen the organization’s digital defenses over time.

DORA introduces comprehensive requirements around third-party risk management, particularly focusing on ICT service providers. Financial entities must now maintain a detailed Register of Information that goes far beyond the traditional outsourcing register. This register must clearly document which vendors support which ICT services, how these services relate to critical or important functions, and how they are contractually governed.

The goal is to achieve full visibility into the ICT supply chain. Not just direct vendors, but also their subcontractors ("vendor’s vendor"). This holistic view helps organizations better understand their dependencies, assess potential vulnerabilities, and ensure continuity of key operations.

KPMG can assist organizations in building and maintaining this register of information, performing third-party risk assessments, and establishing governance processes that comply with DORA. We also support contractual remediation to align existing agreements with regulatory expectations. Furthermore, we can help organizations integrate their Third-party Risk Management processes into platforms like ServiceNow or OneTrust, enabling scalable, efficient management of third-party risks across the enterprise.

DORA encourages financial entities to participate in trusted information-sharing arrangements to enhance collective situational awareness of cyber threats and vulnerabilities. By voluntarily sharing threat intelligence and best practices with other entities, organizations contribute to a more resilient financial ecosystem. In the future, regulators may facilitate or mandate more structured sharing platforms to support this goal.