ISACA Provides Guidance Around EU’s Proposed Digital Operational Resilience Act
Reforms following the 2008 financial crisis helped strengthen the resilience of the financial sector, but did not fully address digital operational resilience. The European Union’s recently released Digital Operational Resilience Act (DORA) draft is designed to provide digital operational resilience rules for EU financial institutions, and ISACA provides guidance on this proposal in its new white paper, Digital Operational Resilience in the EU Financial Sector: A Risk-Based Approach.
When finalized, DORA will enact rules for financial services system operators like investment firms, credit institutions, trading venues and electronic money institutions to ensure these systems’ stability and resilience to cyber incidents. Digital Operational Resilience in the EU Financial Sector outlines the objectives and legal basis for DORA, as well as its information and communication technology (ICT) requirements around risk management, information and cybersecurity, incident reporting, testing, and oversight of third-party service providers, some of which include:
- Set up and maintain resilient ICT systems and tools that minimize the impact of ICT risk.
- Have an ICT risk-management framework that includes strategies, policies, procedures, ICT protocols and tools necessary to effectively protect all relevant physical components and infrastructures from risk, such as damage and unauthorized access or usage.
- Test the ICT business continuity policy and the ICT disaster recovery plan at least yearly, and after substantive changes to the ICT systems.
- Include relevant provisions on accessibility, availability, integrity, security and protection of personal data, and guarantees for access, recover and return in the case of failures of the ICT third-party service providers in contracts that govern the relationship with third-party providers.
“The requirements laid out in DORA to identify all sources of ICT risk on a continuous basis and mandate an annual review of ICT risk management frameworks and review after a major incident, audit or testing are a step in the right direction,” says Chris Dimitriadis, ISACA chief global strategy officer. “However, to further strengthen the act, ISACA encourages provisions ensuring that ICT risk management plans go beyond being a compliance exercise by embedding governance responsibility within the management body, as well as requiring continuous training and ICT awareness of senior management and staff and independent testing performed by testers who are certified.”
During this period in which the DORA regulation is under consideration in the European Parliament and Council of the EU, ISACA’s EU Task Force is engaging with policy makers and sharing feedback. The final version of the regulation is expected in an estimated 18-24 months.
“ISACA is recognized among policy makers as an independent source of expertise on cybersecurity issues. The variety of backgrounds and experience of our members, reflected in the EU Task Force, have been welcomed by policy makers who have valued our contributions to the debate,” says Emily Bastedo, ISACA director for global government relations and public affairs.
To download a complimentary copy of Digital Operational Resilience in the EU Financial Sector, visit https://store.isaca.org/s/store#/store/browse/detail/a2S4w000004L1sxEAC. Additional publications that may be helpful for financial entities as they prepare for DORA include ISACA’s Risk IT Framework, 2nd Edition; Risk IT Practitioner Guide, 2nd Edition; and IT Risk Fundamentals Study Guide. Other IT risk-related resources can be found at www.isaca.org/resources/it-risk.
For more than 50 years, ISACA® (www.isaca.org) has advanced the best talent, expertise and learning in technology. ISACA equips individuals with knowledge, credentials, education and community to progress their careers and transform their organizations, and enables enterprises to train and build quality teams. ISACA is a global professional association and learning organization that leverages the expertise of its more than 150,000 members who work in information security, governance, assurance, risk and privacy to drive innovation through technology. It has a presence in 188 countries, including more than 220 chapters worldwide. In 2020, ISACA launched One In Tech, a philanthropic foundation that supports IT education and career pathways for under-resourced, under-represented populations.
To view this piece of content from cts.businesswire.com, please give your consent at the top of this page.
About Business Wire
Subscribe to releases from Business Wire
Subscribe to all the latest releases from Business Wire by registering your e-mail address below. You can unsubscribe at any time.
Latest releases from Business Wire
Everest Group Recognizes SoftServe as a Key Player in Digital Services within the Life Sciences Landscape30.11.2022 18:47:00 CET | Press release
SoftServe, a leader in digital services and consulting, has been recognized as an Aspirant in Everest Group's Life Sciences Digital Services PEAK Matrix® Assessment 2022. Everest Group is a provider of strategic research insights on IT, business processes, and engineering services and a global Business Process Outsourcing (BPO) research firm. This press release features multimedia. View the full release here: https://www.businesswire.com/news/home/20221130005890/en/ Everest Group Recognizes SoftServe as a Key Player in Digital Services within the Life Sciences Landscape (Graphic: Business Wire) The Life Sciences Digital Services PEAK Matrix® Assessment 2022 covers the top digital life sciences service providers, best-in-class solutions and products, and top locations, according to Everest Group's research. This is the first time SoftServe has been named in the Life Sciences sector. SoftServe debuted with an impressive score in Everest Group's two assessment areas: vision and strategy a
Leading Payments Innovator Chooses Verimatrix XTD Technology to Bolster Cybersecurity30.11.2022 17:45:00 CET | Press release
Regulatory News: Verimatrix, (Euronext Paris: VMX), the leader in powering the modern connected world with people-centered security, today announced that Norway-based Tidypay, a provider of enterprise-level payment solutions that are flexible enough for businesses of all sizes, selected Verimatrix Extended Threat Defense (XTD) technologies to protect and monitor the apps that power its solutions. A top European payment services provider that aims to greatly simplify the payment journey, Tidypay looked to Verimatrix XTD to strengthen security for its Tidypay One, Tidypay eCom and Tidypay GO solutions that serve as the backbones of its many services, including integrated POS systems, accounting systems and individual mobile standalone devices. Through Verimatrix XTD, the company, its partners and users benefit from proven defenses against application repackaging, debuggers, dynamic modification, emulators, reverse engineering, and more. “Verimatrix shares our vision of efficiency and sim
IWBI Launches the WELL Equity Rating to Advance Organizations and Places Where “Everyone Feels Welcome, Seen and Heard”30.11.2022 17:27:00 CET | Press release
The International WELL Building Institute (IWBI) announced today the launch of the WELL Equity Rating, a new rating designed to help organizations act on their diversity, equity, inclusion and accessibility goals, and improve company culture and employee health. Over 30 leading organizations – including AvalonBay Communities, Canderel, Empire State Realty Trust, JLL, Overbury, Shaw Industries and the State University of New York (SUNY) College of Environmental Science and Forestry – have already enrolled in the rating, demonstrating their commitment to creating places where everyone has an equalopportunity to thrive. This press release features multimedia. View the full release here: https://www.businesswire.com/news/home/20221130005749/en/ (Graphic: Business Wire) By providing an evidence-based roadmap, the WELL Equity Rating empowers organizations to better address the needs of marginalized and underserved populations and take an action-oriented approach to creating equitable, people
NielsenIQ Releases New Report Focusing on Sustainability’s Impact on Consumer-Packed Goods Industry30.11.2022 16:30:00 CET | Press release
Today, NielsenIQ released "The Changing Climate of Sustainability," a new report focused on the impact of climate change on the consumer-packaged goods industry. Over the next five years, it is anticipated that governance and cost, will force manufacturers, brands, and retailers to transform and commit to real, sustainable business models to mitigate short- and long-term risk. "Sustainability has been on the corporate agenda for some time, as a slow burn priority where some businesses have made proactive decisions to get ahead of the pack and others have taken a wait and see approach," says Regan Leggett, Foresight Leader, NielsenIQ. "Exploding energy costs, crop failures, and supply chain disruption are all forcing companies to future-proof existing business models or bear uncertainty and increased cost implications." Amid supply chain challenges, inflationary pressures, and cautious consumer spending intentions, the report indicates that consumers are more informed about sustainabili
Sentry Acquires Codecov30.11.2022 16:00:00 CET | Press release
Sentry, the leader in developer-first application monitoring, today announced it has acquired Codecov, the leading dedicated code coverage reporting solution, providing developers with actionable insights into their workflow. The acquisition expands Sentry’s product offering for development teams to improve code quality and velocity even earlier in the development life cycle, helping to accelerate remediation and enabling the delivery of better end-user experiences. “Our mission has always been to empower developers to ship high quality code, faster than anyone else through context and insights, versus dashboards and tools that frankly weren’t built for resolution,” said Milin Desai, CEO of Sentry. “The Codecov team shares this singular focus – and enables us to offer developers even more comprehensive insight into their application’s code quality earlier in the development cycle.” Codecov is the leading dedicated code coverage solution, which helps thousands of development teams at co
In our pressroom you can read all our latest releases, find our press contacts, images, documents and other relevant information about us.Visit our pressroom