* [Cyber Risk](/cyber-risk)[Cybersecurity In-Depth: Feature articles on security strategy, latest trends, and people to know.](/program/the-edge) Preparing for DORA Amid Technical Controls Ambiguity Preparing for DORA Amid Technical Controls Ambiguity=========================================================================================================The European Union’s Digital Operational Resilience Act requires financial entities to focus on third-party risk, resilience, and testing.  [Martin Greenfield](/author/martin-greenfield), CEONovember 8, 2024 4 Min Read  Source: Sikov via Adobe Stock Photo [](https://www.linkedin.com/sharing/share-offsite/?url=https://www.darkreading.com/cyber-risk/preparing-for-dora-amidst-technical-controls-ambiguity)[](http://www.facebook.com/sharer/sharer.php?u=https://www.darkreading.com/cyber-risk/preparing-for-dora-amidst-technical-controls-ambiguity)[](http://www.twitter.com/intent/tweet?url=https://www.darkreading.com/cyber-risk/preparing-for-dora-amidst-technical-controls-ambiguity)[](/cdn-cgi/l/email-protection#714e0204131b1412054c210314011003181f1651171e0351353e233051301c181551251412191f1812101d51321e1f05031e1d0251301c1318160418050857101c014a131e15084c3854434105191e04161905544341051914544341171e1d1d1e06181f1654434117031e1c5443413510031a54434123141015181f165443411c18161905544341181f051403140205544341081e045f544135544130544135544130544341210314011003181f16544341171e03544341353e2330544341301c1815544341251412191f1812101d544341321e1f05031e1d02544341301c1318160418050854413554413019050501025442305443375443370606065f1510031a03141015181f165f121e1c54433712081314035c0318021a544337010314011003181f165c171e035c151e03105c101c181502055c051412191f1812101d5c121e1f05031e1d025c101c13181604180508)[](https://www.reddit.com/submit?url=https://www.darkreading.com/cyber-risk/preparing-for-dora-amidst-technical-controls-ambiguity&title=Preparing%20for%20DORA%20Amid%20Technical%20Controls%20Ambiguity) COMMENTARYJanuary 2025 is a big month for the finance industry — and the clock is ticking. The Digital Operational Resilience Act (DORA) is set to shape how financial entities, such as banks, insurance companies, and investment firms, approach their IT infrastructure and data security. According to Article 3 (1), this regulation will enhance ‘the ability of a financial entity to build, assure and review its operational integrity and reliability.’Although IT security and digital resilience form a part of the reforms that followed the 2008 financial crisis, they’ve taken a back seat over the years. DORA aims to address the rising cyber threat.Member states across the European Union have until January to comply with this new regulation or risk severe fallout. A breach could result in fines of up to 2% of an organization’s total annual worldwide revenue or up to 1% of the company’s average daily worldwide revenue.Despite the urgent call to action, delays are making it difficult for institutions to prepare. While the scoping and harmonization templates were due to the commission in July, public release is uncertain. There are currently no sets of controls or technical standards, so how are those being impacted meant to prepare?But with time running out, financial entities do not have the luxury of watching and waiting. Without any real guidance, it’s in their best interest to take matters into their own hands and do what they can with the information they have.Size Equals Complexity———————-As with many new regulations, one of the key challenges is complexity — and DORA takes that to a whole new level, with six chapters and over 280 articles. It introduces a series of new standards and controls that companies must meet and for which a complete restructure of processes may be required.Remember, DORA is a regulation, not a framework, so comprehending the many requirements is job No. 1 for organizations. To ensure compliance, organizations need full visibility over all company assets. This allows organizations to continuously monitor all systems and identify and address any potential gaps in security.You Can’t Protect What You Can’t See————————————Technology is a borderless entity; DORA calls for complete visibility, despite the vast array of interconnected devices used by firms. The new regulation focuses heavily on data and providing clear and actionable evidence. DORA places a particular emphasis on third-party risk, resilience, and testing — areas currently without an existing framework and becoming more vulnerable every year.PCI security standards, for example, focus solely on protecting credit card information. NIST’s Cybersecurity Framework covers certain elements of recovery and fills the gap left by PCI, but it still doesn’t cover reporting. DORA, on the other hand, doesn’t focus so much on penetration testing but more on threat-based testing, requiring organizations to emulate a threat rather than conduct a vulnerability scan.So instead of monitoring for any existing cybersecurity vulnerabilities, the new regulations require organizations to monitor for any potential weaknesses — identifying and rectifying them before they can trigger unnecessary risk. This approach minimizes the risks of vulnerabilities developing and ensures organizations have real-time updates on the state of their security.What Can Business Do at This Stage?———————————–One thing DORA is very clear on is an emphasis on results and the need to continually monitor for threats. This regulation should not to be taken lightly. Under DORA, authorities have the power to request data and execute powers to assess a company’s compliance with these regulations.As a first step, organizations should conduct a thorough gap-analysis exercise to identify areas in need of improvement — within their own business as well as across their supply chains. Ahead of January, organizations must ensure that their risk management strategies are up to date. Right or wrong, DORA assumes firms have a sufficient risk management framework in place. The same is expected of parties in the supply chain, although how far down the chain is yet to be determined.All parties involved need to obtain and maintain detailed knowledge of all critical assets at any given time. Tools that continuously monitor all assets provide real-time critical information on processes across the company. Only through continuous monitoring can organizations understand where the gaps in their security are and ensure they are properly addressed.Regardless of delays, DORA is coming and businesses must be prepared. Organizations that view this incoming regulation as more than just another push for compliance — and instead a platform from which to truly enhance their security posture — will gain that all-important competitive edge. Through continuous monitoring and effective threat management, organizations will achieve a new level of protection across their entire network. [](https://www.linkedin.com/sharing/share-offsite/?url=https://www.darkreading.com/cyber-risk/preparing-for-dora-amidst-technical-controls-ambiguity)[](http://www.facebook.com/sharer/sharer.php?u=https://www.darkreading.com/cyber-risk/preparing-for-dora-amidst-technical-controls-ambiguity)[](http://www.twitter.com/intent/tweet?url=https://www.darkreading.com/cyber-risk/preparing-for-dora-amidst-technical-controls-ambiguity)[](/cdn-cgi/l/email-protection#aa95d9dfc8c0cfc9de97fad8cfdacbd8c3c4cd8accc5d88aeee5f8eb8aebc7c3ce8afecfc9c2c4c3c9cbc68ae9c5c4ded8c5c6d98aebc7c8c3cddfc3ded38ccbc7da91c8c5ced397e38f989adec2c5dfcdc2de8f989adec2cf8f989accc5c6c6c5ddc3c4cd8f989accd8c5c78f989aeecbd8c18f989af8cfcbcec3c4cd8f989ac7c3cdc2de8f989ac3c4decfd8cfd9de8f989ad3c5df848f9aee8f9aeb8f9aee8f9aeb8f989afad8cfdacbd8c3c4cd8f989accc5d88f989aeee5f8eb8f989aebc7c3ce8f989afecfc9c2c4c3c9cbc68f989ae9c5c4ded8c5c6d98f989aebc7c8c3cddfc3ded38f9aee8f9aebc2dededad98f99eb8f98ec8f98ecdddddd84cecbd8c1d8cfcbcec3c4cd84c9c5c78f98ecc9d3c8cfd887d8c3d9c18f98ecdad8cfdacbd8c3c4cd87ccc5d887cec5d8cb87cbc7c3ced9de87decfc9c2c4c3c9cbc687c9c5c4ded8c5c6d987cbc7c8c3cddfc3ded3)[](https://www.reddit.com/submit?url=https://www.darkreading.com/cyber-risk/preparing-for-dora-amidst-technical-controls-ambiguity&title=Preparing%20for%20DORA%20Amid%20Technical%20Controls%20Ambiguity) About the Author—————- [Martin Greenfield](/author/martin-greenfield) CEO, Quod Orbis Martin Greenfield is the CEO of Continuous Controls Monitoring solutions provider, Quod Orbis. He has over two decades in the cyber security space. With his team, Martin helps deliver complete cyber controls visibility for our clients via a single pane of glass, through Quod Orbis’ Continuous Controls Monitoring (CCM) platform. Their clients can see and understand their security and risk posture in real time, which in turn drives their risk investment decisions at the enterprise level. [See more from Martin Greenfield](/author/martin-greenfield) Keep up with the latest cybersecurity threats, newly discovered vulnerabilities, data breach information, and emerging trends. Delivered daily or weekly right to your email inbox. [Subscribe](https://dr-resources.darkreading.com/free/w_defa3135/prgm.cgi)You May Also Like*** ** * ** ***More Insights Webinars* [Unleashing AI to Assess Cyber Security Risk](https://dr-resources.darkreading.com/c/pubRD.mpl?secure=1&sr=pp&_t=pp:&qf=w_dark71&ch=SBX&cid=_upcoming_webinars_8.500001492&_mc=_upcoming_webinars_8.500001492)Nov 12, 2024* [Securing Tomorrow, Today: How to Navigate Zero Trust](https://dr-resources.darkreading.com/c/pubRD.mpl?secure=1&sr=pp&_t=pp:&qf=w_defa7186&ch=SBX&cid=_upcoming_webinars_8.500001490&_mc=_upcoming_webinars_8.500001490)Nov 13, 2024* [The State of Attack Surface Management (ASM), Featuring Forrester](https://dr-resources.darkreading.com/c/pubRD.mpl?secure=1&sr=pp&_t=pp:&qf=w_defa7317&ch=SBX&cid=_upcoming_webinars_8.500001501&_mc=_upcoming_webinars_8.500001501)Nov 15, 2024* [Applying the Principle of Least Privilege to the Cloud](https://dr-resources.darkreading.com/c/pubRD.mpl?secure=1&sr=pp&_t=pp:&pc=w_wiza60&ch=SBX&cid=_upcoming_webinars_8.500001499&_mc=_upcoming_webinars_8.500001499)Nov 18, 2024* [The Right Way to Use Artificial Intelligence and Machine Learning in Incident Response](https://dr-resources.darkreading.com/c/pubRD.mpl?secure=1&sr=pp&_t=pp:&qf=w_defa7194&ch=SBX&cid=_upcoming_webinars_8.500001491&_mc=_upcoming_webinars_8.500001491)Nov 20, 2024[More Webinars](/resources?types=Webinar) Events* [Know Your Enemy: Understanding Cybercriminals and Nation-State Threat Actors](https://darkreadingve.tradepub.com/c/pubRD.mpl?secure=1&sr=pp&_t=pp:&qf=w_defa7059&ch=SBX&cid=_session_16.500327&_mc=_session_16.500327)Nov 14, 2024* [Cybersecurity Outlook 2025](https://darkreading.tradepub.com/c/pubRD.mpl?secure=1&sr=pp&_t=pp:&qf=w_defa7201&ch=SBX&cid=_session_16.500326&_mc=_session_16.500326)Dec 5, 2024[More Events](/events) Latest Articles in The Edge* [Preparing for DORA Amid Technical Controls Ambiguity](/cyber-risk/preparing-for-dora-amidst-technical-controls-ambiguity)Nov 8, 2024 -| 4 Min Read* [Attackers Breach IT-Based Networks Before Jumping to ICS/OT Systems](/ics-ot-security/attackers-breach-network-provider-ot-ics-network)Nov 6, 2024 -| 1 Min Read* [How Playing Cyber Games Can Help You Get Hired](/cybersecurity-careers/how-playing-cyber-games-can-help-you-get-hired)Nov 6, 2024 -| 4 Min Read* [Name That Edge Toon: Aerialist’s Choice](/mobile-security/name-that-edge-toon-aerialist-choice)Nov 4, 2024 -| 1 Min Read[Read More The Edge](/program/the-edge)
Related Tags:
NAICS: 921 – Executive
Legislative
Other General Government Support
NAICS: 54 – Professional
Scientific
Technical Services
NAICS: 541 – Professional
Scientific
Technical Services
NAICS: 52 – Finance And Insurance
NAICS: 92 – Public Administration
NAICS: 523 – Securities
Commodity Contracts
Other Financial Investments And Related Activities
NAICS: 522 – Credit Intermediation And Related Activities
Blog: Dark Reading
Create or Modify System Process: Windows Service
Associated Indicators: