What is DORA? A step towards increased cybersecurity
Digitalization is moving fast, and the financial sector faces more cyber threats and new challenges. Digital resilience needs to be stronger to keep the business running, protect customer data and maintain trust.
In response, the EU introduced the Digital Operational Resilience Act (DORA), a regulation to strengthen the digital resilience of the financial sector. DORA has applied since 17 January 2025. It requires financial institutions to have structured risk management frameworks and efficient incident response plans, and to report certain security incidents to supervisory authorities.
Who does DORA apply to?
DORA mainly applies to the financial sector, including banks, insurance companies, auditing firms and other financial service providers. Its impact is broader than that, since the stability and security of these institutions matter for the whole economy.
What are the 5 key aspects of DORA?
1. Governance and Risk Management
Financial entities need to understand their current IT risks and also anticipate future ones. A well-documented risk management framework helps organizations adapt their strategies quickly when conditions change.
2. Incident Reporting
As cyber threats evolve, it is more important than ever to identify, handle and report incidents quickly. A strong early warning system leads to faster action. That can be the difference between a minor disruption and a major crisis.
Sweet has experience of managing incidents proactively. We document and handle incidents in a process that follows our ISO 27001 information security certification. We suggest and help our clients implement the same method. Want to know more? CONTACT US
3. Testing of Digital Operational Resilience
Continuous testing helps organizations find weaknesses before they become serious problems. It is not only about finding gaps, but also about fixing them quickly.
At Sweet, we regularly test different scenarios to identify risks and make improvements. External security companies also run vulnerability and penetration tests for us, to find gaps before they become problems.
4. Management of ICT Third-Party Risks
Many services are outsourced or delivered as cloud solutions, so third-party risks are increasingly important to manage. By understanding and monitoring these risks, organizations make sure they are not exposed through their partners.
At Sweet, our partners are expected to maintain a high level of security. We audit them regularly to make sure they meet our and our clients’ security requirements.
(ICT stands for “Information and Communication Technology”: all technologies used to handle and communicate information. ICT risks are threats and vulnerabilities that can affect these systems and the information in them. They are not only technical. They can also be organizational, human or process-related. Managing them takes a mix of technology, policies, procedures and training.)
5. Information Sharing
Knowledge is power. When financial entities share information about threats, techniques and tactics, they benefit from collective intelligence, strengthen their defenses and manage risks proactively.
What does DORA mean for IT departments?
DORA is an important step for digital resilience in the financial sector. For IT departments, it is a chance to review and strengthen processes, systems and partnerships. Working on these areas helps the financial sector prepare for future digital challenges.
Sweet Systems and information security
At Sweet, we take security very seriously, both to run a secure operation and to keep the trust of our stakeholders. We have been ISO 27001 certified for several years. This international standard for information security shows our commitment to high security in all our systems, services and processes.
The certification means our security controls have been carefully reviewed. We continuously monitor, review and improve our IT security.
Contact us if you want to learn more or read more about DORA here.
Frequently asked questions about DORA
What is DORA?
DORA (Digital Operational Resilience Act) is an EU regulation that aims to strengthen the digital resilience of the financial sector, with requirements for risk management, incident response and reporting of certain security incidents.
When did DORA start to apply?
DORA has applied since 17 January 2025.
Who does DORA apply to?
Primarily the financial sector, for example banks, insurance companies, auditing firms and other financial service providers.
What does ICT mean?
ICT stands for Information and Communication Technology, meaning all technologies used to handle and communicate information. ICT risks can be technical, but also organizational, human and process-driven.
How does Sweet work with DORA-related requirements?
Sweet is ISO 27001 certified, has a documented incident management process, regularly tests different scenarios and uses an external security partner for vulnerability and penetration tests. Read more in How we ensure DORA compliance.
