ESA Announcement (RoI's)
A Critical Milestone in Preparing for DORA Compliance
by Paul C Dwyer
Introduction
As the cybersecurity landscape evolves, the financial sector faces unprecedented regulatory scrutiny. The European Supervisory Authorities (ESAs)—comprising the EBA, EIOPA, and ESMA—recently announced a pivotal timeline to collect data necessary for the designation of Critical ICT Third-Party Providers (CTPPs) under the Digital Operational Resilience Act (DORA).
This announcement underscores the immediacy of compliance efforts as the regulation becomes applicable from 17 January 2025.
For senior executives in the financial sector, this development is not just another regulatory checkpoint—it is a wake-up call to prioritise compliance readiness.
This announcement underscores the immediacy of compliance efforts as the regulation becomes applicable from 17 January 2025.
For senior executives in the financial sector, this development is not just another regulatory checkpoint—it is a wake-up call to prioritise compliance readiness.
Key Implications of the Announcement
The ESAs have mandated competent authorities to submit registers of information on contractual arrangements by 30 April 2025. These registers will form the backbone of the CTPP designation process, enabling oversight of service providers critical to operational resilience.
Although a dry run involving over 1,000 entities has already been conducted, the final standards for these registers remain in draft form, awaiting adoption. This presents an urgent challenge for financial entities to proactively align their internal documentation and ICT contracts.
Although a dry run involving over 1,000 entities has already been conducted, the final standards for these registers remain in draft form, awaiting adoption. This presents an urgent challenge for financial entities to proactively align their internal documentation and ICT contracts.
Why Does This Matter to You?
1. Tight Timelines: With only a few months between DORA’s application date and the submission deadline, entities must ensure complete and accurate registers of information.
2. High Stakes: Missteps in compliance could result in severe penalties, reputational damage, and operational disruptions.
2. High Stakes: Missteps in compliance could result in severe penalties, reputational damage, and operational disruptions.
3. Systemic Relevance: The ESAs aim to standardise data collection and oversee systemic entities, extending their focus beyond traditional financial institutions to third-party providers and intra-group arrangements.
ICTTF Your DORA Compliance Education Partner
What Financial Executives Must Do Now
The urgency of this announcement cannot be overstated. Here’s how senior leaders should respond:
-Identify gaps in existing contractual arrangements and initiate updates to align with DORA’s expectations.
-Develop robust reporting mechanisms that can withstand scrutiny from competent authorities and auditors.
3. Participate in Industry Support Initiatives:
1. Review Existing Contracts:
-Ensure that all ICT third-party service agreements include clauses for data sharing, audits, and compliance with regulatory requirements.
-Identify gaps in existing contractual arrangements and initiate updates to align with DORA’s expectations.
2. Enhance Internal Processes:
-Assign responsibility for compiling registers of information.
-Develop robust reporting mechanisms that can withstand scrutiny from competent authorities and auditors.
3. Participate in Industry Support Initiatives:
-Take advantage of resources such as ESA workshops, including the upcoming virtual session on 18 December 2024. These sessions provide insights into preparing for compliance.
Why You Should Consider the DCCS Course
At this critical juncture, education and readiness are key. The DCCS DORA Certified Compliance Specialist course, recognised as the de facto industry standard, is continually updated to reflect regulatory developments.
From mapping compliance frameworks to practical case studies, the course equips financial executives with the tools to navigate DORA effectively.
Attendees will gain insights into:
Visit dccscourse.com now and enrol immediately.
Join the EU DORA Summit
To complement your preparation, consider attending the EU DORA Summit on 17 January 2025. Yes, that’s DORA DAY! The date DORA is law!
This premier event will provide real-time analysis of DORA’s rollout and actionable insights from regulators, industry leaders, and compliance specialists.
The Summit held in Dublin, will focus on strategic, operational, and technical imperatives, ensuring attendees leave equipped to meet compliance obligations with confidence.
From mapping compliance frameworks to practical case studies, the course equips financial executives with the tools to navigate DORA effectively.
Attendees will gain insights into:
• Strategies for aligning ICT risk management practices with regulatory expectations.
• Practical steps for preparing registers of information.
• Insights into overlapping frameworks like NIS2, GDPR, and ISO 27001.
Visit dccscourse.com now and enrol immediately.
Join the EU DORA Summit
To complement your preparation, consider attending the EU DORA Summit on 17 January 2025. Yes, that’s DORA DAY! The date DORA is law!
This premier event will provide real-time analysis of DORA’s rollout and actionable insights from regulators, industry leaders, and compliance specialists.
The Summit held in Dublin, will focus on strategic, operational, and technical imperatives, ensuring attendees leave equipped to meet compliance obligations with confidence.
Learn more at dorasummit.eu
Conclusion
The ESA’s timeline for data collection is a defining moment in DORA’s implementation. For financial entities, the stakes are high, and the window for preparation is narrow.
Proactive measures, guided by expert training and participation in industry events, will be crucial for navigating the road ahead.
Proactive measures, guided by expert training and participation in industry events, will be crucial for navigating the road ahead.
As a recognised leader in cybersecurity, compliance, and risk management, I encourage you to act decisively. By leveraging resources like the DCCS course and the EU DORA Summit, you can ensure your organisation not only meets compliance standards but strengthens its resilience against evolving cyber threats. www.paulcdwyer.com
Side Bar: Legal Challenges and the RoI’s etc
So you heard something about this, let me summarise that for you:
The Digital Operational Resilience Act (DORA) mandates that financial entities maintain comprehensive registers of information (RoI) detailing their contractual arrangements with ICT third-party service providers.
These registers are crucial for the European Supervisory Authorities (ESAs) to designate Critical ICT Third-Party Providers (CTPPs) and oversee their activities.
These registers are crucial for the European Supervisory Authorities (ESAs) to designate Critical ICT Third-Party Providers (CTPPs) and oversee their activities.
Legal Challenges Surrounding the RoI Documents
Standardisation and Compliance:
Implementing Technical Standards (ITS): The ESAs developed draft ITS to standardise the RoI templates. However, the European Commission rejected these drafts, particularly concerning the mandatory use of the Legal Entity Identifier (LEI) for identifying ICT third-party service providers. This rejection has led to uncertainties about the final structure and content of the RoI, complicating compliance efforts for financial entities.
Data Privacy and Confidentiality: Sensitive Information Disclosure: The RoI requires detailed information about contractual relationships, which may include sensitive data. Ensuring compliance with data protection regulations, such as the General Data Protection Regulation (GDPR), while fulfilling DORA's requirements presents a legal challenge.
Regulatory Overlap and Coordination: Multiple Regulatory Bodies: Financial entities often operate under various regulatory frameworks. Aligning the RoI with existing obligations and ensuring consistency across different jurisdictions can be legally complex.
Timeline Constraints: Implementation Deadlines: The ESAs have set a deadline of 30 April 2025 for competent authorities to submit the RoI. Given the ongoing legal clarifications and the need for potential adjustments to the RoI templates, financial entities face tight timelines to ensure compliance.
Recommendations for the Management Board:
Proactive Engagement: Stay informed about developments related to the ITS and any legal clarifications issued by the ESAs or the European Commission.
Legal and Expert Consultation: Engage legal and DORA experts to navigate data privacy concerns and ensure that the RoI complies with all relevant regulations.
Resource Allocation: Dedicate resources to prepare the RoI promptly, considering potential revisions and the tight submission deadlines.
Training and Awareness: Ensure that relevant teams are aware of the legal requirements and challenges associated with the RoI to facilitate accurate and compliant documentation.
By addressing these legal challenges proactively, the management board can steer the organisation toward full compliance with DORA's requirements, thereby enhancing the entity's operational resilience.
Implementing Technical Standards (ITS): The ESAs developed draft ITS to standardise the RoI templates. However, the European Commission rejected these drafts, particularly concerning the mandatory use of the Legal Entity Identifier (LEI) for identifying ICT third-party service providers. This rejection has led to uncertainties about the final structure and content of the RoI, complicating compliance efforts for financial entities.
Data Privacy and Confidentiality: Sensitive Information Disclosure: The RoI requires detailed information about contractual relationships, which may include sensitive data. Ensuring compliance with data protection regulations, such as the General Data Protection Regulation (GDPR), while fulfilling DORA's requirements presents a legal challenge.
Regulatory Overlap and Coordination: Multiple Regulatory Bodies: Financial entities often operate under various regulatory frameworks. Aligning the RoI with existing obligations and ensuring consistency across different jurisdictions can be legally complex.
Timeline Constraints: Implementation Deadlines: The ESAs have set a deadline of 30 April 2025 for competent authorities to submit the RoI. Given the ongoing legal clarifications and the need for potential adjustments to the RoI templates, financial entities face tight timelines to ensure compliance.
Recommendations for the Management Board:
Proactive Engagement: Stay informed about developments related to the ITS and any legal clarifications issued by the ESAs or the European Commission.
Legal and Expert Consultation: Engage legal and DORA experts to navigate data privacy concerns and ensure that the RoI complies with all relevant regulations.
Resource Allocation: Dedicate resources to prepare the RoI promptly, considering potential revisions and the tight submission deadlines.
Training and Awareness: Ensure that relevant teams are aware of the legal requirements and challenges associated with the RoI to facilitate accurate and compliant documentation.
By addressing these legal challenges proactively, the management board can steer the organisation toward full compliance with DORA's requirements, thereby enhancing the entity's operational resilience.
About the Author
Paul C Dwyer is a globally recognised expert in cybersecurity, cyber risk, and compliance. As the Head Tutor at the ICTTF Cyber Risk Academy, he has authored the industry-standard DCCS DORA Certified Compliance Specialist Course and the influential book Navigating DORA - A Financial Executive's Roadmap to Compliance and Resilience. Paul is also the developer of DORAGPT, a cutting-edge AI tool described as the "Swiss Army Knife of DORA Compliance," and the founder of the EU DORA Summit. With decades of experience advising financial institutions, Paul provides unparalleled insights into achieving resilience and regulatory excellence under DORA. Learn more at paulcdwyer.com
HEAD OFFICE
-
ICTTF Ltd
Unit 8, Kinsealy Business Park,
Kinsealy Lane,
Malahide,
Co Dublin
K36 CX92 -
info@icttf.org
support@icttf.org -
+353 (0)1 905 3263
Copyright © - All Rights Reserved - ICTTF Ltd. - Registered Company in Ireland: 567446 - VAT No IE3395678DH