The Digital Operational Resilience Act, known as the DORA regulation, is in full effect as of January 17, 2025, and with it comes numerous IT disaster recovery (DR) and testing requirements for financial services institutions and third party Information and Communication Technology (ICT) vendors.
This article overviews the various aspects and challenges of meeting compliance in IT disaster recovery and specifically how to meet the DORA framework regulation requirements.
The fundamentals of disaster recovery compliance
Disaster recovery compliance encompasses many facets from risk assessment to data protection, regulatory compliance to testing and documentation.
What is disaster recovery compliance?
First, let’s define it. Disaster recovery compliance is the act of ensuring that your organization meets all relevant laws, regulations and industry standards to recover and restore important business services and applications.
How regulatory requirements shape compliance disaster recovery strategies
A disaster recovery strategy cannot be complete without considering relevant regulatory requirements. Regulations often define or impact required recovery time objectives (RTO) and recovery point objectives (RPO). Regulations can also recommend or mandate the frequency and types of disaster recovery plans, tests, methods of communication (both internal and external), and timeframe for the notification of regulatory authorities of incidents, etc.
Without considering these components, a DR strategy would not be complete.
Key components of a disaster recovery compliance framework
As with any business requirements, a structured compliance framework is best practice. A disaster recovery compliance framework outlines the processes and procedures to execute on the disaster recovery strategy. Key framework components include:
- Disaster recovery plan development
- Testing scenarios and frequency
- Recovery procedure documentation and runbooks
- Training plans
- Communication plan and methods
- List of supporting technology tools (technology recovery stack)
Key risks for businesses face without a structured compliance framework
The likelihood of violating or breaching regulations significantly increases without a runbook oriented structure and regular testing of the procedures. Risks include data loss, longer downtimes which can lead to complete regulatory violation, brand damage, financial repercussions, and more.
DORA challenges in disaster recovery compliance
When considering the impact on IT disaster recovery, the European Union’s DORA regulation poses a multitude of challenges including:
- Managing risks from ICT third parties including cloud providers and software vendors
- IT application and system mapping to understand dependencies, criticality tiering, and priority during recovery
- Testing recovery and disaster recovery resilience scenarios is complex and requires widespread coverage to accurately represent an actual failure
- Manual incident reporting and auditing is cumbersome, time-consuming, and error-prone
- Communication is often ad-hoc and disjointed during an incident, test scenario or live recovery
Key requirements for disaster recovery regulatory compliance under DORA
The DORA regulation strives to improve cybersecurity and resilience of financial institutions with various measures and protocols, but categorizes major requirements into a few key areas to ensure disaster recovery regulatory compliance and robust operational resilience.
ICT risk management and incident reporting
Information and communication technology (ICT) is a major focal point in DORA. The regulation mandates that any risk from an ICT third party provider be managed by the financial institution. It puts the onus on the financial entity to ensure that any risks from software, computer, telecommunications, cloud platforms, etc. are included in their risk management framework.
This framework should be comprehensive and well documented to monitor, handle, and follow up on any ICT-related incidents.This key requirement expands the breadth of risk.
Additionally, DORA mandates a standardized process for logging and reporting internal and external ICT-related incidents.
Periodic testing of disaster recovery plans
The DORA law requires enterprises to implement annual testing programs for risk-based digital operational resilience. The testing needs to be comprehensive, simulating the entire disaster recovery process to identify any weaknesses and ensure disaster recovery compliance with DORA’s regulatory requirements
ICT third-party risk management
DORA emphasizes the importance of managing risks associated with ICT third-party providers. This includes due diligence on the provider, including security expectations in contractual agreements and monitoring performance.
For example, legal firms, cloud providers and other service providers are required to outline and meet service level agreements (SLAs) which include uptime requirements, RTO, RPO, and other key recovery metrics. These commitments are typically dependent on database size, disaster recovery strategy, etc. The financial institution is responsible for ensuring that these recovery metrics satisfy the DORA regulation and align with disaster recovery compliance requirements.
Information sharing for resilience measures
Another key requirement, or pillar, is sharing information and intelligence amongst financial institutions. This includes proactively sharing cyber threat intelligence and incident details with other financial companies and regulatory bodies to support disaster recovery regulatory compliance. It also refers to participating in industry forums to stay up-to-date on industry updates to learn from others’ experiences and stay continually prepared.
Best practices for achieving compliance disaster recovery readiness
With the DORA regulation already in full effect, effective January 17, 2025, it’s important to ensure continued preparedness and compliance. Here are a few best practices:
- Review the key pillars and understand the specific requirements
- Conduct a risk assessment including ICT risks
- Create an incident response plan and disaster recovery plans using automated runbooks
- Regularly conduct resilience simulation tests that mirror real life scenarios and analyze results to incorporate lessons learned
- Share information within the financial services industry and stay informed of industry resilience and cybersecurity trends
- Train staff on all procedures including testing, reporting and compliance
- Regularly monitor compliance status
Additionally, it’s important to stay up-to-date on any amendments to DORA or other regulations that can impact your organization. Cutover Recover can help you enhance your resilience posture. Learn more - book a demo today.