DORA: What EU-Supervised Banks Must Do Before January 2025 — TGB Regulatory & Policy Brief July 2024

A rulebook that is nearly complete

DORA, Regulation (EU) 2022/2554 of 14 December 2022, was published in the Official Journal on 27 December 2022 and applies from 17 January 2025. It covers credit institutions and the other financial entities listed in its scope article, and it also reaches ICT third-party service providers. The regulation set the ESAs two deadlines for the technical standards that give it practical form: 17 January 2024 for the standards on ICT risk management, incident classification, the third-party policy and the register of information templates, and 17 July 2024 for those on incident reporting, TLPT, oversight and subcontracting.

The first deadline was met. On 17 January 2024 the ESAs published final drafts of four instruments: standards on the ICT risk management framework and its simplified version, standards on the classification of ICT-related incidents, standards on the policy for ICT services provided by third parties, and implementing standards setting the templates for the register of information. The consultation behind them, which ran from 19 June to 11 September 2023, drew more than 420 responses. The Commission adopted three of these as delegated regulations on 13 March 2024, and all three were published in the Official Journal on 25 June 2024. Separately, Delegated Regulation 2024/1502, adopted on 22 February 2024 and published on 30 May 2024, set the criteria the ESAs will use to designate critical ICT third-party service providers. In April 2024 the ESAs still referred to the register templates as final draft implementing standards.

Most of the second set arrived on time: on 17 July 2024 the ESAs published four final draft regulatory technical standards, one set of implementing standards and two guidelines. The package covers the content, templates and timelines for reporting major incidents, TLPT, the conditions for oversight of critical providers and the make-up of joint examination teams, plus guidelines on estimating aggregated costs and losses of major incidents and on oversight cooperation. The guidelines have been adopted; the technical standards have gone to the Commission, which aims to adopt them in the coming months. The consultation drew more than 364 responses, of which 265 were on the technical standards and 99 on the two guidelines. One mandate remains open: the ESAs said the standards on subcontracting will be published in due course.

The practical consequence is that banks are building to texts in different legal states. Three sets of standards are law, the second batch is final draft, and the subcontracting rules have not yet appeared. In our view, final drafts that have already been through consultation are a sound basis for build decisions, but banks should keep their contract templates for subcontracting flexible until the last text is published.

Status of DORA technical standards and criteria, July 2024

Source: European Commission (Official Journal of the EU), Commission Delegated Regulation (EU) 2024/1774 on ICT risk management tools, methods, processes and policies, 25 June 2024; European Commission (Official Journal of the EU), Commission Delegated Regulation (EU) 2024/1772 on the classification of ICT-related incidents and cyber threats, 25 June 2024; European Commission (Official Journal of the EU), Commission Delegated Regulation (EU) 2024/1773 on the policy for ICT services supporting critical or important functions, 25 June 2024; European Commission (Official Journal of the EU), Commission Delegated Regulation (EU) 2024/1502 on criteria for designating critical ICT third-party service providers, 30 May 2024; European Supervisory Authorities (EBA, EIOPA, ESMA), ESAs publish first set of rules under DORA for ICT and third-party risk management and incident classification, 17 January 2024; European Supervisory Authorities (EBA, EIOPA, ESMA), ESAs publish second batch of policy products under DORA, 17 July 2024.

Governance: the board owns ICT risk

DORA puts ICT risk squarely on the management body. The management body must define, approve, oversee and be responsible for all ICT risk management arrangements, and bear the ultimate responsibility for managing the institution's ICT risk. Its members must keep their knowledge and skills up to date, including through specific training on a regular basis. It must also allocate, and periodically review, the budget needed to meet the bank's digital operational resilience needs, including security awareness, resilience training and ICT skills for all staff. Responsibility for managing and overseeing ICT risk must sit with a control function that has an appropriate level of independence and is kept separate from internal audit. The ICT risk management framework itself must be documented and reviewed at least once a year, and again after major ICT-related incidents.

Delegated Regulation 2024/1774 turns these principles into specific controls. Two examples show how granular the requirements are. Access rights must be updated at least every 6 months for systems supporting critical or important functions and at least once a year for other systems. Business continuity plan tests must use an adequate set of severe but plausible scenarios and, where applicable, cover ICT services delivered by third-party providers. For many banks, the gap will lie less in the existence of policies than in evidence that these cycles actually run.

Incident classification and reporting

DORA sets a single regime for reporting major ICT-related incidents. Banks must file an initial notification, an intermediate report and a final report, the last once the root cause analysis is complete. Significant institutions report to their national competent authority, which immediately transmits the report to the European Central Bank (ECB).

Whether an incident is major is decided by Delegated Regulation 2024/1772. An incident is major if it has affected critical services and either involves successful, malicious and unauthorised access that may result in data losses, or meets two or more of the other materiality thresholds. Recurring incidents that occur at least twice within 6 months with the same apparent root cause, and that together meet the criteria, count as one major incident, and banks must assess recurrence monthly.

Thresholds for classifying a major ICT-related incident

Source: European Commission (Official Journal of the EU), Commission Delegated Regulation (EU) 2024/1772 on the classification of ICT-related incidents and cyber threats, 25 June 2024.

The reporting clock is set by the final draft standards published on 17 July 2024. The initial notification is due as early as possible within 4 hours of classifying the incident as major, and no later than 24 hours after the bank became aware of it. The intermediate report follows within 72 hours of the initial notification, and the final report no later than one month after the latest updated intermediate report. Measuring the later deadlines from the previous submission, rather than from classification, gives up to 24 hours more for the intermediate report and at least 72 hours more for the final report than the consultation draft.

Credit institutions get less relief than many other financial entities. Where a deadline falls on a weekend or bank holiday, financial entities may generally file by noon on the next working day, but that option does not apply to initial notifications and intermediate reports from credit institutions. The template has been slimmed, however: the ESAs cut the reporting fields from 84 to 59 and limited the initial notification to 10 fields, 7 of them mandatory, after a consultation that drew 109 responses. The practical test for banks is whether their incident desks can classify against these thresholds, around the clock, quickly enough to start a 4-hour clock with confidence.

Third-party risk: the register, contracts and exit

The register of information is a data-intensive requirement. Banks must maintain it at entity, sub-consolidated and consolidated level, covering all contractual arrangements for ICT services from third-party providers. They must also report at least yearly on the number of new arrangements, the categories of providers, the types of contract and the services provided. The register is more than a compliance file: the ESAs will use it both to supervise compliance and to designate critical ICT third-party service providers.

To prepare, the ESAs announced in April 2024 a voluntary dry run in which financial entities would submit registers through their competent authorities between 1 July and 30 August. The ESAs said that from 2025 financial entities will have to maintain registers on their use of ICT third-party providers.

Contracts are the second workstream. For services supporting critical or important functions, contracts must include the provider's obligation to participate in the bank's TLPT, unrestricted rights of access, inspection and audit, and exit strategies with a mandatory adequate transition period. Banks must also put exit strategies in place for these services, with exit plans that are tested and reviewed periodically. Renegotiating existing contracts with large providers on these terms may take longer than the time that remains before DORA applies, which argues for prioritising contracts by criticality.

At the other end of the chain, Delegated Regulation 2024/1502 sets out how critical providers will be identified. A provider meets the first-step systemic-impact test where its share of financial entities and of their total assets is at least 10% in at least one category, and the ESAs will draw on the registers of information for the assessment. A further criterion is met where a provider's services are used by at least one G-SII, at least three O-SIIs, or one O-SII with a score above 3 000. Once designated, a critical provider can face periodic penalty payments of up to 1% of its average daily worldwide turnover for non-compliance with the Lead Overseer's measures.

The ECB is moving in parallel. On 3 June 2024 it opened a consultation, which closed on 15 July 2024, on a Guide on outsourcing cloud services to cloud service providers. It said it had found vulnerabilities in banks' IT outsourcing arrangements during its 2023 SREP, and that third-party risk, including cloud outsourcing, remains high among its supervisory priorities for 2024-2026. It also noted that the cloud market is highly concentrated, with many banks relying on just a few service providers located in non-European countries.

Testing: yearly tests and TLPT

Banks other than microenterprises must ensure, at least yearly, that appropriate tests are run on all ICT systems and applications supporting critical or important functions. Entities identified by their authorities must also carry out TLPT at least every 3 years. Under the final draft standards on TLPT, authorities would have to require credit institutions identified as G-SIIs or O-SIIs, or part of such groups, to perform TLPT. The criteria reach beyond banks: payment institutions that exceeded EUR 150 billion in total value of payment transactions in each of the previous two financial years would also be in scope. Significant credit institutions may use only external testers.

The standards also set a demanding test cycle. The active red team phase must last at least twelve weeks, testers must deliver their report within four weeks of its end, and the blue team report and replay must follow no later than ten weeks after it. Scoping a test, procuring external testers and agreeing contract clauses that oblige providers to take part will all take time, so banks likely to be identified should start early.

The ECB has already begun testing how banks would recover from a cyberattack. In January 2024 it announced a cyber resilience stress test of 109 directly supervised banks, assessing how they respond to and recover from a successful cyberattack rather than whether they can prevent one, with 28 banks undergoing an enhanced assessment. The exercise will not affect capital through Pillar 2 guidance; findings will feed into the 2024 SREP, and the main findings will be communicated in the summer of 2024.

Priorities before DORA applies

Four tasks matter most before DORA applies on 17 January 2025, in our view. First, banks should complete a register of information at every required level of consolidation, drawing on the dry run where they take part. Second, they should embed the classification thresholds and reporting clock in incident procedures, including weekend cover. Third, they should remediate contracts for critical or important functions, starting with the providers on which they depend most. Fourth, management bodies should be able to show that they understand ICT risk and own the framework.

The supervisory signal is consistent. Supervisors have flagged weaknesses in outsourcing and concentration in cloud services, and are testing recovery capability, ahead of the application date. We expect early supervisory work under DORA to focus on the quality of registers and incident reports, since these are the data sources on which both supervision and the oversight of critical providers depend.

Primary sources: European Parliament and Council (Official Journal of the EU), Regulation (EU) 2022/2554 on digital operational resilience for the financial sector (DORA), 27 December 2022; European Supervisory Authorities (EBA, EIOPA, ESMA), ESAs publish second batch of policy products under DORA, 17 July 2024; European Supervisory Authorities (Joint Committee), JC 2024 33: Final report on draft RTS and ITS on major incident reporting under DORA, 17 July 2024; European Commission (Official Journal of the EU), Commission Delegated Regulation (EU) 2024/1772 on the classification of ICT-related incidents and cyber threats, 25 June 2024; European Commission (Official Journal of the EU), Commission Delegated Regulation (EU) 2024/1773 on the policy for ICT services supporting critical or important functions, 25 June 2024; European Commission (Official Journal of the EU), Commission Delegated Regulation (EU) 2024/1774 on ICT risk management tools, methods, processes and policies, 25 June 2024; European Central Bank (Banking Supervision), ECB to stress test banks’ ability to recover from cyberattack (press release), 3 January 2024; European Supervisory Authorities (EBA, EIOPA, ESMA), ESAs publish first set of rules under DORA for ICT and third-party risk management and incident classification, 17 January 2024; European Commission (Official Journal of the EU), Commission Delegated Regulation (EU) 2024/1502 on criteria for designating critical ICT third-party service providers, 30 May 2024; European Supervisory Authorities (EBA, EIOPA, ESMA), ESAs to run voluntary dry run exercise to prepare industry for the next stage of DORA implementation, 11 April 2024; European Central Bank (Banking Supervision), ECB consults on outsourcing cloud services (press release), 3 June 2024; European Supervisory Authorities (Joint Committee), JC 2024 29: Final report on draft RTS on threat-led penetration testing under DORA, 17 July 2024.