Homepage Axence
Wcag tools
DORA

DORA

Everything you need to know

Do you work in the financial sector? Be it a bank, an insurance agency or a cryptocurrency broker. All of these organisations will soon be subject to DORA requirements. With Axence, preparing for the new standards is much easier.

Image

Who does DORA apply to?

The DORA regulation applies to all financial institutions, such as banks, insurance companies, investment funds and other financial service providers. More specifically:

Image

Credit institutions

Image

Payment institutions

Image

Account information access service providers

Image

Electronic money institutions

Image

Investment companies

Image

Service providers operating in the cryptocurrency market

Image

Central securities depositories

Image

Central counterparties

Image

Trading systems

Image

Trade repositories

Image

Alternative investment fund management organisations

Image

Management companies

Image

Information access service providers

Image

Insurance and reinsurance companies

Image

Insurance intermediaries

Image

Institutions for occupational retirement provision

Image

Credit rating agencies

Image

Administrators of critical benchmarks

Image

Crowdfunding service providers

Image

Securitisation repositories

Image

External ICT service providers

When does DORA come into force?

The DORA regulation was drafted in 2020. The law came into force on 16 January 2023, but the EU lawmakers provided for a 24-month period of vacatio legis. This means that the regulation entered into force on 17 January 2025.

Image

ICT service providers - new requirements

According to the DORA regulation, financial institutions can only work with ICT service providers that meet the highest information security standards.
Axence is such a provider, which it confirms by signing an additional annex to the contract with each financial sector customer at the start of the cooperation. It complies with the DORA regulation.
 

Image

How can you prepare for the implementation of the DORA regulation? Axence answers!

Responsibilities arising from DORA can be divided into 5 key areas. In many of these areas, you will be supported by Axence’s solutions: the advanced network and IT infrastructure management tool - Axence nVision®.

 

Image

Information and communication technology risk management

Image

Incident management and reporting of major ICT-related incidents to the relevant authorities
 

Image

Testing of digital business resilience    

Image

Managing of ICT third-party risk

Image

Sharing information and analyses on cyber threats and vulnerabilities in this area
 

 

How can Axence nVision® help you meet the requirements of the DORA regulation?

DORA Article 6
Asset management and mapping
The ICT risk management framework shall include at least strategies, policies, procedures, ICT protocols and tools that are necessary to duly and adequately protect all information assets and ICT assets, including computer software, hardware, servers, as well as to protect all relevant physical components and infrastructures, such as premises, data centres and sensitive designated areas, to ensure that all information assets and ICT assets are adequately protected from risks including damage and unauthorised access or usage.
Axence's answer
nVision’s Inventory module enables comprehensive mapping of all types of assets, including information assets, infrastructure components, hardware and software. This will enable you to meet the key requirements for financial entities arising from the DORA regulation.
DORA Article 8
Identification of assets
  1. As part of the ICT risk management framework referred to in Article 6(1), financial entities shall identify, classify and adequately document all ICT supported business functions, roles and responsibilities, the information assets and ICT assets supporting those functions, and their roles and dependencies in relation to ICT risk. Financial entities shall review as needed, and at least yearly, the adequacy of this classification and of any relevant documentation.
  2. Financial entities shall identify all information assets and ICT assets, including those on remote sites, network resources and hardware equipment, and shall map those considered critical. They shall map the configuration of the information assets and ICT assets and the links and interdependencies between the different information assets and ICT assets.
  3. Financial entities shall identify and document all processes that are dependent on ICT third-party service providers, and shall identify interconnections with ICT third-party service providers that provide services that support critical or important functions.
Axence's answer
The Inventory module also responds to this issue, allowing all the specified areas to be mapped. Importantly, DORA also states that the links and interdependencies between assets should be mapped, and the Inventory module in nVision 16.0 responds to this with the ability to create arbitrary interdependencies between assets. With nVision you will also meet this requirement of DORA.
DORA Article 9
Protection and prevention
  1. For the purposes of adequately protecting ICT systems and with a view to organising response measures, financial entities shall continuously monitor and control the security and functioning of ICT systems and tools and shall minimise the impact of ICT risk on ICT systems through the deployment of appropriate ICT security tools, policies and procedures.
  2. Financial entities shall design, procure and implement ICT security policies, procedures, protocols and tools that aim to ensure the resilience, continuity and availability of ICT systems, in particular for those supporting critical or important functions, and to maintain high standards of availability, authenticity, integrity and confidentiality of data, whether stored, in use or transmitted
  3. In order to achieve the objectives referred to in paragraph 2, financial entities shall use ICT solutions and processes that are appropriate in accordance with Article 4. Those ICT solutions and processes shall:
    1. ensure the security of the means of transfer of data;
    2. minimise the risk of corruption or loss of data, unauthorised access and technical flaws that may hinder business activity;
    3. prevent the lack of availability, the impairment of authenticity and integrity, breaches of confidentiality and the loss of data;
    4. ensure that data is protected from risks arising from data management, including poor administration, processing-related risks and human error.
Axence's answer
These provisions refer to ensuring the resilience, continuity and availability of ICT systems, in particular those supporting critical or important functions. This is where the anomaly detection and unavailability alerts in the nVision’s Network module come in.

Paragraph three, in turn, relates to data protection. It is the nVision’s DataGuard module>/strong> that will help you meet the requirements of these provisions. It allows you to create policies for blocking USB media, auditing media operations and monitoring operations on local directories and network shares.
DORA Article 10
Detection
  1. Financial entities shall have in place mechanisms to promptly detect anomalous activities, in accordance with Article 17, including ICT network performance issues and ICT-related incidents, and to identify potential material single points of failure.
  2. Financial entities shall devote sufficient resources and capabilities to monitor user activity, the occurrence of ICT anomalies and ICT-related incidents, in particular cyber-attacks.
Axence's answer
With nVision, events and anomalies that indicate potential incidents can be detected, documented and handled in the HelpDesk module. The HelpDesk module allows you to create categories and specific forms for incidents, and assign responsible people to manage each category. It is also possible to create a category for information security incidents to record cases that may indicate security breaches.

The nVision’s Users module allows you to monitor user activities to ensure compliance with the above provisions of DORA.
DORA Article 17
ICT-related incident management process
  1. Financial entities shall define, establish and implement an ICT-related incident management process to detect, manage and notify ICT-related incidents.
  2. Financial entities shall record all ICT-related incidents and significant cyber threats. Financial entities shall establish appropriate procedures and processes to ensure a consistent and integrated monitoring, handling and follow-up of ICT-related incidents, to ensure that root causes are identified, documented and addressed in order to prevent the occurrence of such incidents.

The ICT-related incident management process referred to in paragraph 1 shall:

  1. put in place early warning indicators;
  2. establish procedures to identify, track, log, categorise and classify ICT-related incidents according to their priority and severity and according to the criticality of the services impacted, in accordance with the criteria set out in Article 18(1);
  3. assign roles and responsibilities that need to be activated for different ICT-related incident types and scenarios;
  4. set out plans for communication to staff, external stakeholders and media in accordance with Article 14 and for notification to clients, for internal escalation procedures, including ICT-related customer complaints, as well as for the provision of information to financial entities that act as counterparts, as appropriate;
  5. ensure that at least major ICT-related incidents are reported to relevant senior management and inform the management body of at least major ICT-related incidents, explaining the impact, response and additional controls to be established as a result of such ICT-related incidents;
  6. establish ICT-related incident response procedures to mitigate impacts and ensure that services become operational and secure in a timely manner.
Axence's answer
With nVision, events and anomalies that indicate potential incidents can be detected, documented and handled in the HelpDesk module. The HelpDesk module allows you to create categories and specific forms for incidents, and assign responsible people to manage each category. It is also possible to create a category for information security incidents to record cases that may indicate security breaches. Managing an incident has never been easier.